General

  • Target

    27092024_1439_25092024_PAYMENT factuur 234550 Eur488700pdf.zip

  • Size

    669KB

  • Sample

    240927-r1l57szcnd

  • MD5

    6ce716d34de84326cd9d61aac96ef36e

  • SHA1

    33d6e6534da55511d1013bb599d1968ad8433208

  • SHA256

    3393d7f246656d6178dcff63bb1b5ea47a357a7d159a53760baadb0430ea0157

  • SHA512

    2b7c22d45b63f3978691ad0ccdceb3a994525b7568de964cf06d2a6654deada6d9fa4328574d6be1ef17ab7478135bb87607b56412541cc52c51492abc816997

  • SSDEEP

    12288:EObT/zcJZnqsRzcp1wq3RO6NPYrwwg9U4JbKtlVj6:Es/cHU1ThXYrMU4JbKtlo

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

e23y

Decoy

stiloeconforto.shop

79nn470gl.autos

ffg.autos

elix-saaac.buzz

tlasbet88win.sbs

inoliga.app

777.fun

avada-ga-3.press

avandakitchen.online

61ep864tr.autos

igitalonlineseva.online

ar-deals-15908.bond

sqqpkv.pro

368i8rnoy.xyz

lxspinsenin.lol

9y204r7eo.sbs

toptalkingaboutit.net

eeplab.xyz

filmyhit.vip

athroom-remodeling-59089.bond

Targets

    • Target

      PAYMENT factuur 234550 Eur488700pdf.exe

    • Size

      1.1MB

    • MD5

      cee86cae45481078e9c569238d1cda91

    • SHA1

      f509377bc3c9c4f44cfe98fdcefcef5f943464fb

    • SHA256

      eb2c93d6312b097ba3254cfd33b236eb8d76b6eb8374d8944cf0bee0724e1b69

    • SHA512

      bc2e7065ef3a3531b79fff592fb7a25cb7b33e733a3aedbd67f6dea6891af90cfdac19ebe17cc4fc7b664d2392e6b0f6cb9c304d54a741daf1cd46429c78e8d3

    • SSDEEP

      24576:AAHnh+eWsN3skA4RV1Hom2KXMmHa+Yjuw4Jb22K5:3h+ZkldoPK8Ya+GuFt2D

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks