General

  • Target

    220527f91eba446d157c6ef8b0d29b0a47907f6e74e5a4a307efe667be6b084b.exe

  • Size

    1.1MB

  • Sample

    240926-bmzw5s1gma

  • MD5

    ac0d95c5e5822d99efede44898f59296

  • SHA1

    481243791ff40babf0d0460e3370f6d1f0b42cb1

  • SHA256

    220527f91eba446d157c6ef8b0d29b0a47907f6e74e5a4a307efe667be6b084b

  • SHA512

    6395ca842a120507d6e4596ca54dee94c07f84238b8eec3cb02f1c62f19436e81317e22a74abe1dcc0984135c59148850e9c7217d3e7918395a90241f2ae3938

  • SSDEEP

    24576:8RmJkcoQricOIQxiZY1iaA4Ys7dzWAw0bx6vkkMevlZ:pJZoQrbTFZY1iaAAxze0bxyT

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

e62s

Decoy

ellinksa.shop

uckyspinph.xyz

owdark.net

arriage-therapy-72241.bond

w7ijko4rv4p97b.top

heirbuzzwords.buzz

aspart.shop

ctivemail5-kagoya-com.info

shacertification9.shop

zitcd65k3.buzz

llkosoi.info

ru8.info

rhgtrdjdjykyetrdjftd.buzz

yschoollist.kiwi

oftfolio.online

rograma-de-almacen-2.online

oudoarms.top

mwquas.xyz

orjagaucha.website

nlinechat-mh.online

Targets

    • Target

      220527f91eba446d157c6ef8b0d29b0a47907f6e74e5a4a307efe667be6b084b.exe

    • Size

      1.1MB

    • MD5

      ac0d95c5e5822d99efede44898f59296

    • SHA1

      481243791ff40babf0d0460e3370f6d1f0b42cb1

    • SHA256

      220527f91eba446d157c6ef8b0d29b0a47907f6e74e5a4a307efe667be6b084b

    • SHA512

      6395ca842a120507d6e4596ca54dee94c07f84238b8eec3cb02f1c62f19436e81317e22a74abe1dcc0984135c59148850e9c7217d3e7918395a90241f2ae3938

    • SSDEEP

      24576:8RmJkcoQricOIQxiZY1iaA4Ys7dzWAw0bx6vkkMevlZ:pJZoQrbTFZY1iaAAxze0bxyT

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks