Resubmissions

27-09-2024 20:02

240927-ysl9kazbjd 10

General

  • Target

    d680261fb4d68f03216d8cb56648bce8a416b821a9692e14789eccbe24c8f04fN

  • Size

    1.1MB

  • Sample

    240927-ysl9kazbjd

  • MD5

    d2e4e90dd7b91cdedd4f5f2fe58184b0

  • SHA1

    9bb020d804cb5119842b15dd6cec240337ebb5b3

  • SHA256

    d680261fb4d68f03216d8cb56648bce8a416b821a9692e14789eccbe24c8f04f

  • SHA512

    38a37a4c69286b7d34b86ae5ab27ac76d26868a329e86ff0342f31d5ef25c408f25328999bfa970b86f2fac67cf7f00875bdd8b5d5751b1d8d281c44028563ed

  • SSDEEP

    24576:uRmJkcoQricOIQxiZY1iaC+Yu82vCaskCebDy0DQ:7JZoQrbTFZY1iaC+QgC5Svy7

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

e62s

Decoy

ellinksa.shop

uckyspinph.xyz

owdark.net

arriage-therapy-72241.bond

w7ijko4rv4p97b.top

heirbuzzwords.buzz

aspart.shop

ctivemail5-kagoya-com.info

shacertification9.shop

zitcd65k3.buzz

llkosoi.info

ru8.info

rhgtrdjdjykyetrdjftd.buzz

yschoollist.kiwi

oftfolio.online

rograma-de-almacen-2.online

oudoarms.top

mwquas.xyz

orjagaucha.website

nlinechat-mh.online

Targets

    • Target

      d680261fb4d68f03216d8cb56648bce8a416b821a9692e14789eccbe24c8f04fN

    • Size

      1.1MB

    • MD5

      d2e4e90dd7b91cdedd4f5f2fe58184b0

    • SHA1

      9bb020d804cb5119842b15dd6cec240337ebb5b3

    • SHA256

      d680261fb4d68f03216d8cb56648bce8a416b821a9692e14789eccbe24c8f04f

    • SHA512

      38a37a4c69286b7d34b86ae5ab27ac76d26868a329e86ff0342f31d5ef25c408f25328999bfa970b86f2fac67cf7f00875bdd8b5d5751b1d8d281c44028563ed

    • SSDEEP

      24576:uRmJkcoQricOIQxiZY1iaC+Yu82vCaskCebDy0DQ:7JZoQrbTFZY1iaC+QgC5Svy7

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks