General

  • Target

    20240929162138.zip

  • Size

    856KB

  • Sample

    240919-w9xerathpj

  • MD5

    8ce054ef9af958646a066234e40fbee7

  • SHA1

    43cdc1036e7a74857388dbb86c745e204f2cc845

  • SHA256

    6847b2cf324705137789c759e1779c8f1d3ec8350804f9155a16df91a4dbbd7a

  • SHA512

    036d63a2f893f7619597f2cbb534185a2d7cbb862f5c02dbdf3718c25258550f45204745d65142d266db5de913194d712b884e84fd092051de576f8f007794f6

  • SSDEEP

    24576:zzaqtRE5KkvYH6zGYHwbODDzA9i0/BFxwsF:/DWKkwHxbODwBBFCsF

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

c24t

Decoy

ealthbridgeccs.online

ngelicais.art

uktuksu1.sbs

fapoker.asia

hecreature.tech

orenzoplaybest14.xyz

op-smartphones-deal.today

delark.click

7395.asia

otnews.cfd

j16e.xyz

oko.events

fscxb.top

roudtxliberals.vote

asas-br.bond

ourhealthyourlife.shop

fbpd.top

j9u9.xyz

uijiuw.top

aming-chair-37588.bond

Targets

    • Target

      20240929162138.exe

    • Size

      1.1MB

    • MD5

      98e9de2d6078c01e65d3f41ab1edb255

    • SHA1

      b48af26ed35457a945ea8283b5ac3e53d626a26e

    • SHA256

      3c321f4c7feb1233711409ad1fc9371732c24a302d3e5b9cd5e238ab1a638288

    • SHA512

      99c003bdcd15576f4a686d4a945b2993f426ff95858409cf3afdf005a0e39850cd1db955445ec8a2ba394bfdde0b3a9682161edf6fb68752db815f473903d8d0

    • SSDEEP

      24576:uRmJkcoQricOIQxiZY1iaCc3cPGY9obOhDzA1iu/RZxUkx:7JZoQrbTFZY1iaCkzbOhuNRZqkx

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks