General

  • Target

    SOA89035673890.exe

  • Size

    1.1MB

  • Sample

    240927-p7mzzatcnk

  • MD5

    f2a9270835ef7d0db0a287867cb98f6f

  • SHA1

    3d3b9b719b0d4c1040e3b337ecae1f5b8729f5db

  • SHA256

    e518c029a8b513fd3c2e77c475f8bd19c54c8a15d38198d878c8322a7b491f52

  • SHA512

    3b6339a3434693dd9076469ee757805e7e2b78d14c77624a0a4b3b9a65f9b8a275137f5e8638abebfd5da7dbe1592aa7300543905d93a118779ae15f04c80837

  • SSDEEP

    24576:8RmJkcoQricOIQxiZY1iaADPzYJw7P04dA2iGKowNCC:pJZoQrbTFZY1iaADPzpzqhaw8C

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

e62s

Decoy

ellinksa.shop

uckyspinph.xyz

owdark.net

arriage-therapy-72241.bond

w7ijko4rv4p97b.top

heirbuzzwords.buzz

aspart.shop

ctivemail5-kagoya-com.info

shacertification9.shop

zitcd65k3.buzz

llkosoi.info

ru8.info

rhgtrdjdjykyetrdjftd.buzz

yschoollist.kiwi

oftfolio.online

rograma-de-almacen-2.online

oudoarms.top

mwquas.xyz

orjagaucha.website

nlinechat-mh.online

Targets

    • Target

      SOA89035673890.exe

    • Size

      1.1MB

    • MD5

      f2a9270835ef7d0db0a287867cb98f6f

    • SHA1

      3d3b9b719b0d4c1040e3b337ecae1f5b8729f5db

    • SHA256

      e518c029a8b513fd3c2e77c475f8bd19c54c8a15d38198d878c8322a7b491f52

    • SHA512

      3b6339a3434693dd9076469ee757805e7e2b78d14c77624a0a4b3b9a65f9b8a275137f5e8638abebfd5da7dbe1592aa7300543905d93a118779ae15f04c80837

    • SSDEEP

      24576:8RmJkcoQricOIQxiZY1iaADPzYJw7P04dA2iGKowNCC:pJZoQrbTFZY1iaADPzpzqhaw8C

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks