General

  • Target

    6.exe

  • Size

    1.1MB

  • Sample

    240927-rl99gswfkp

  • MD5

    204bf0a40413ca96504ed28e4f61190f

  • SHA1

    b1dd9e5ee4c999d61a281528cbeb162fc81449bd

  • SHA256

    8fde044b46296592bf2bdd606aeed873d0a56ef2343b36a49b3fa1d25326864d

  • SHA512

    aedac199e7bf78bbf19a84103d4b72deab78014d59c061e2394bfc84e5722bdb52e814d938d6dc62094c1300e4b581ba91cd2097bcf608969b5d4aa2bbecb835

  • SSDEEP

    24576:YAHnh+eWsN3skA4RV1Hom2KXMmHaBVGyfQIkgNvppD/H5:fh+ZkldoPK8YaBg+kgNvnDR

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

e23y

Decoy

stiloeconforto.shop

79nn470gl.autos

ffg.autos

elix-saaac.buzz

tlasbet88win.sbs

inoliga.app

777.fun

avada-ga-3.press

avandakitchen.online

61ep864tr.autos

igitalonlineseva.online

ar-deals-15908.bond

sqqpkv.pro

368i8rnoy.xyz

lxspinsenin.lol

9y204r7eo.sbs

toptalkingaboutit.net

eeplab.xyz

filmyhit.vip

athroom-remodeling-59089.bond

Targets

    • Target

      6.exe

    • Size

      1.1MB

    • MD5

      204bf0a40413ca96504ed28e4f61190f

    • SHA1

      b1dd9e5ee4c999d61a281528cbeb162fc81449bd

    • SHA256

      8fde044b46296592bf2bdd606aeed873d0a56ef2343b36a49b3fa1d25326864d

    • SHA512

      aedac199e7bf78bbf19a84103d4b72deab78014d59c061e2394bfc84e5722bdb52e814d938d6dc62094c1300e4b581ba91cd2097bcf608969b5d4aa2bbecb835

    • SSDEEP

      24576:YAHnh+eWsN3skA4RV1Hom2KXMmHaBVGyfQIkgNvppD/H5:fh+ZkldoPK8YaBg+kgNvnDR

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks