General

  • Target

    6fe2dc92e64b03a0d07ac33bbd6dbdb5c245d6cd21fa50fec42dab36ecef80a9

  • Size

    683KB

  • Sample

    241001-erdq9azdjp

  • MD5

    46ac6e5cfbbe87eadbfe8ddcc932db51

  • SHA1

    9cca744131d51397f660dea965b3bacaeb032541

  • SHA256

    6fe2dc92e64b03a0d07ac33bbd6dbdb5c245d6cd21fa50fec42dab36ecef80a9

  • SHA512

    54677cb1a70aa392e6397ec884c0c9318d557c054931efdb6e20e9cb694cf7bd5e734f5f0108344d557ea2892042db4bb150851d4e882dd22c46cec3382645e2

  • SSDEEP

    12288:e8hcUPAC8Nloy+BnSzEaIALCk6N815xpva4r+Vu7d8VIS:HhXPA7NWsTHWk6N6xVzyKd8qS

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

hy08

Decoy

weazc.top

servoceimmpajhnuz.info

vqemkdhi.xyz

wergol.com

spa-mk.com

rtpsid88.life

tatetits.fun

raidsa.xyz

suojiansuode.net

jointhejunction.com

wudai.net

typeboot.shop

mksport-app.com

miocloud.ovh

taipan77pandan.com

wwwhg58a.com

khuahamiksai31.pro

carpedatumllc.net

safebinders.com

krx21.com

Targets

    • Target

      6fe2dc92e64b03a0d07ac33bbd6dbdb5c245d6cd21fa50fec42dab36ecef80a9

    • Size

      683KB

    • MD5

      46ac6e5cfbbe87eadbfe8ddcc932db51

    • SHA1

      9cca744131d51397f660dea965b3bacaeb032541

    • SHA256

      6fe2dc92e64b03a0d07ac33bbd6dbdb5c245d6cd21fa50fec42dab36ecef80a9

    • SHA512

      54677cb1a70aa392e6397ec884c0c9318d557c054931efdb6e20e9cb694cf7bd5e734f5f0108344d557ea2892042db4bb150851d4e882dd22c46cec3382645e2

    • SSDEEP

      12288:e8hcUPAC8Nloy+BnSzEaIALCk6N815xpva4r+Vu7d8VIS:HhXPA7NWsTHWk6N6xVzyKd8qS

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks