General

  • Target

    a0ec8ea072fa0a81fb5e660f8aa278d9c06bb361080845911208d6579d15605a.exe

  • Size

    1.1MB

  • Sample

    240923-bsq67aserl

  • MD5

    39791818339b4e65f0d41b14f140a4e0

  • SHA1

    d8f6f8b7c289d34b9a81180ae764ab0257b8d4fc

  • SHA256

    a0ec8ea072fa0a81fb5e660f8aa278d9c06bb361080845911208d6579d15605a

  • SHA512

    de61350aa0b78dd2884e98bd1bbf4271ded43cf0e45cf0c2fddd3fc038a35a1abcf8f0380d613e55281d416437fdc2f4864cbed024649093dc72d0e65b037dde

  • SSDEEP

    24576:uRmJkcoQricOIQxiZY1iaCWRD74Y20CSdCGxkqi263Va:7JZoQrbTFZY1iaCWF7RUqi2YVa

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

c24t

Decoy

ealthbridgeccs.online

ngelicais.art

uktuksu1.sbs

fapoker.asia

hecreature.tech

orenzoplaybest14.xyz

op-smartphones-deal.today

delark.click

7395.asia

otnews.cfd

j16e.xyz

oko.events

fscxb.top

roudtxliberals.vote

asas-br.bond

ourhealthyourlife.shop

fbpd.top

j9u9.xyz

uijiuw.top

aming-chair-37588.bond

Targets

    • Target

      a0ec8ea072fa0a81fb5e660f8aa278d9c06bb361080845911208d6579d15605a.exe

    • Size

      1.1MB

    • MD5

      39791818339b4e65f0d41b14f140a4e0

    • SHA1

      d8f6f8b7c289d34b9a81180ae764ab0257b8d4fc

    • SHA256

      a0ec8ea072fa0a81fb5e660f8aa278d9c06bb361080845911208d6579d15605a

    • SHA512

      de61350aa0b78dd2884e98bd1bbf4271ded43cf0e45cf0c2fddd3fc038a35a1abcf8f0380d613e55281d416437fdc2f4864cbed024649093dc72d0e65b037dde

    • SSDEEP

      24576:uRmJkcoQricOIQxiZY1iaCWRD74Y20CSdCGxkqi263Va:7JZoQrbTFZY1iaCWF7RUqi2YVa

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks