General

  • Target

    3bc0a08eba4fb6dd392f1ebcc76c47a5b1df2c912e364b08b724bf9d1c86e81c

  • Size

    747KB

  • Sample

    240927-fk7lesyhmb

  • MD5

    afb9e011bce01aa4efcb682f24111db6

  • SHA1

    724d71652a00ac93b3e761778b8b0ed0b96f1a5f

  • SHA256

    3bc0a08eba4fb6dd392f1ebcc76c47a5b1df2c912e364b08b724bf9d1c86e81c

  • SHA512

    d66765678367c2606c8e742ccfd1bca7876dac438954b8b80d8e7364c760b95f77d43124324dc36bc67af87aeb98693783d1e627f3557af2b08eb2425f1e893f

  • SSDEEP

    12288:9YWVlBihvnYEnKdpvlRen7eN9/+DDQ5RQX0lWG502U/Hz33NFW8I8FTSfm:9bwZADNQE9mDDQIEM3v3LW8RFT1

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

e62s

Decoy

ellinksa.shop

uckyspinph.xyz

owdark.net

arriage-therapy-72241.bond

w7ijko4rv4p97b.top

heirbuzzwords.buzz

aspart.shop

ctivemail5-kagoya-com.info

shacertification9.shop

zitcd65k3.buzz

llkosoi.info

ru8.info

rhgtrdjdjykyetrdjftd.buzz

yschoollist.kiwi

oftfolio.online

rograma-de-almacen-2.online

oudoarms.top

mwquas.xyz

orjagaucha.website

nlinechat-mh.online

Targets

    • Target

      DUE INVOICES-SEPTEMBER 2024.exe

    • Size

      1.1MB

    • MD5

      e935df5b9f8f05c32ee0f9e3e7db5de1

    • SHA1

      3d332bd1f017b6064beab2f625af8943b03ea30b

    • SHA256

      e5bb1ba175379b3456a486c9f2fe575e81b2e772894c6d014220a7eed1ea6b81

    • SHA512

      78d1008e8b9c44271d612199c9c0c98b7eb8d616896b999ea16b70020f21b5ad014f3f2dc4dab9ca00596dbeaf26e602a0ef40e38429f4134f46060b175c52d3

    • SSDEEP

      24576:8RmJkcoQricOIQxiZY1iaASkI0D78XOVMHZmtVTSIltL4zXR0PCmn:pJZoQrbTFZY1iaASk5ce6HZadt0N2Cmn

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks