General

  • Target

    4d7b9bb02299bcc46d95f2df772d152d3ebb8445c04e6255040c61fb5ea46312.exe

  • Size

    1.1MB

  • Sample

    241001-bmvmestdpq

  • MD5

    64dbde73e410165a5e6566ed2b2282b6

  • SHA1

    7635298f794a9c7a68ac7675ca33574a765b8fb7

  • SHA256

    4d7b9bb02299bcc46d95f2df772d152d3ebb8445c04e6255040c61fb5ea46312

  • SHA512

    2bb58b47caca2be94fa934b34f6e0630a4281dc63ef908a11155a3986cfdd1316bc6ee93fe41e4486b2e2bc5153c8175b990653c9ef59de81af8ada7222d4b46

  • SSDEEP

    24576:KfmMv6Ckr7Mny5Qtz8SC9Z0TKqIrZopc8jiFiYpn/N9H0:K3v+7/5QtUYLIF8uFHpn19H0

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

e62s

Decoy

ellinksa.shop

uckyspinph.xyz

owdark.net

arriage-therapy-72241.bond

w7ijko4rv4p97b.top

heirbuzzwords.buzz

aspart.shop

ctivemail5-kagoya-com.info

shacertification9.shop

zitcd65k3.buzz

llkosoi.info

ru8.info

rhgtrdjdjykyetrdjftd.buzz

yschoollist.kiwi

oftfolio.online

rograma-de-almacen-2.online

oudoarms.top

mwquas.xyz

orjagaucha.website

nlinechat-mh.online

Targets

    • Target

      4d7b9bb02299bcc46d95f2df772d152d3ebb8445c04e6255040c61fb5ea46312.exe

    • Size

      1.1MB

    • MD5

      64dbde73e410165a5e6566ed2b2282b6

    • SHA1

      7635298f794a9c7a68ac7675ca33574a765b8fb7

    • SHA256

      4d7b9bb02299bcc46d95f2df772d152d3ebb8445c04e6255040c61fb5ea46312

    • SHA512

      2bb58b47caca2be94fa934b34f6e0630a4281dc63ef908a11155a3986cfdd1316bc6ee93fe41e4486b2e2bc5153c8175b990653c9ef59de81af8ada7222d4b46

    • SSDEEP

      24576:KfmMv6Ckr7Mny5Qtz8SC9Z0TKqIrZopc8jiFiYpn/N9H0:K3v+7/5QtUYLIF8uFHpn19H0

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks