General

  • Target

    69face46b3877dfc4118c98c20213df638a7a350c7eb242e1f38e672455131c3.zip

  • Size

    671KB

  • Sample

    240927-brag2sxgrp

  • MD5

    fecbc70a067f49ab3da4d6c11b277683

  • SHA1

    6aff822220eab390c5f5ac837325605b41c7a350

  • SHA256

    69face46b3877dfc4118c98c20213df638a7a350c7eb242e1f38e672455131c3

  • SHA512

    8b0b0dc9fb3646ddd0bbdae83b152933bcdff59a0f383739642905eaf29ddddb16271ed2f7e453c84384b8c864a0b2e2cc8c8c92ea3accde0fa78d60d8368d28

  • SSDEEP

    12288:3KXCMrCcbXei4ZynYJYeRbpVDdA2wv1o8cGLO+RA7E4t6rVIUF08OJpIKvlNwMSV:3ICMrCoYJ7RFVBA2EwGLPG7EW6rVQIK4

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

e23y

Decoy

stiloeconforto.shop

79nn470gl.autos

ffg.autos

elix-saaac.buzz

tlasbet88win.sbs

inoliga.app

777.fun

avada-ga-3.press

avandakitchen.online

61ep864tr.autos

igitalonlineseva.online

ar-deals-15908.bond

sqqpkv.pro

368i8rnoy.xyz

lxspinsenin.lol

9y204r7eo.sbs

toptalkingaboutit.net

eeplab.xyz

filmyhit.vip

athroom-remodeling-59089.bond

Targets

    • Target

      Bonifico 9252024pdf.exe

    • Size

      1.1MB

    • MD5

      561e2701898470b157ac37bd29be6a88

    • SHA1

      402b39b4581207298c2696afb4ebe224da9b597f

    • SHA256

      79e31e087939f413301f214a422c46f9d32ed435fc34822611cb08a74266ba44

    • SHA512

      dcac667d4961f1f282f37d9480efba54f852e6ca7277061ea7b0bbafc77dfbd23b27af6dd299fad448847f1fca9fba849a0dd9b414a1034468981006434ceb70

    • SSDEEP

      24576:rAHnh+eWsN3skA4RV1Hom2KXMmHazloS0vXp6riu/5:Gh+ZkldoPK8Yazl0Xpa

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks