General

  • Target

    59ab557c3e419cd201601311a28669d9eaff788ff92f6cbe6733382d5883f80b.exe

  • Size

    608KB

  • Sample

    240924-bsdk4asapl

  • MD5

    d528fa74a59d1ee418934a42f5513f8d

  • SHA1

    abc8b4592280eee9ae020c3f1db7c5ae8b5bae69

  • SHA256

    59ab557c3e419cd201601311a28669d9eaff788ff92f6cbe6733382d5883f80b

  • SHA512

    24d1754712924f7651c9418f526851282a28d149c9a375328e7d0dc64a265c0f6a11227c71bfb62f344ff9cd46a0e9f54accac5eef00a1a4a8d15435004da646

  • SSDEEP

    12288:SdsoHajQvFIWRfAszEbQ7KPW5nrmlmqbgDIiuvwCTQNFZcmsvsOeIw:bgtQCDKPWrml2DIiUcF1LOex

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

b31a

Decoy

enjamin-paaac.buzz

mail-marketing-40950.bond

pusems28-post.cyou

hindo.top

ruck-company-be.today

asinos-deutschland.net

ewancash.boats

etdopovo.casino

rcher-saaac.buzz

871166.vip

manuel.app

g3yqo.shop

-9way.xyz

qawgytfexe.bond

iefi6834.vip

ental-health-35901.bond

idat-merkez18.top

rojectleadzone.website

lirudolph.top

migloballlc.online

Targets

    • Target

      59ab557c3e419cd201601311a28669d9eaff788ff92f6cbe6733382d5883f80b.exe

    • Size

      608KB

    • MD5

      d528fa74a59d1ee418934a42f5513f8d

    • SHA1

      abc8b4592280eee9ae020c3f1db7c5ae8b5bae69

    • SHA256

      59ab557c3e419cd201601311a28669d9eaff788ff92f6cbe6733382d5883f80b

    • SHA512

      24d1754712924f7651c9418f526851282a28d149c9a375328e7d0dc64a265c0f6a11227c71bfb62f344ff9cd46a0e9f54accac5eef00a1a4a8d15435004da646

    • SSDEEP

      12288:SdsoHajQvFIWRfAszEbQ7KPW5nrmlmqbgDIiuvwCTQNFZcmsvsOeIw:bgtQCDKPWrml2DIiUcF1LOex

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks