General

  • Target

    54dc29f95416b335e2657153e01c1fe014796bdd6bc75299f4edda45d98a2444

  • Size

    676KB

  • Sample

    241002-gsz2zs1bkj

  • MD5

    9af19623b16664a281a2ed28b9ff4c20

  • SHA1

    4334592619c9c22697a03115d3557479dd39e0ed

  • SHA256

    54dc29f95416b335e2657153e01c1fe014796bdd6bc75299f4edda45d98a2444

  • SHA512

    fdc5e3ad4a1b171e2a4f6275a346964bd265e0d60cab267bce0d9db11324136a808c14ef8152b5c533ebb7788b7880d54e2648fc012e6ee58801490971edd72b

  • SSDEEP

    12288:yLgWTG4ma0voAqtWJevyZT6ykN/s+H1Sj4Q2TOvYNttS0e5lv:o7Tb0gAqt7vyppqV04Q2iANttS7z

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

hy08

Decoy

weazc.top

servoceimmpajhnuz.info

vqemkdhi.xyz

wergol.com

spa-mk.com

rtpsid88.life

tatetits.fun

raidsa.xyz

suojiansuode.net

jointhejunction.com

wudai.net

typeboot.shop

mksport-app.com

miocloud.ovh

taipan77pandan.com

wwwhg58a.com

khuahamiksai31.pro

carpedatumllc.net

safebinders.com

krx21.com

Targets

    • Target

      54dc29f95416b335e2657153e01c1fe014796bdd6bc75299f4edda45d98a2444

    • Size

      676KB

    • MD5

      9af19623b16664a281a2ed28b9ff4c20

    • SHA1

      4334592619c9c22697a03115d3557479dd39e0ed

    • SHA256

      54dc29f95416b335e2657153e01c1fe014796bdd6bc75299f4edda45d98a2444

    • SHA512

      fdc5e3ad4a1b171e2a4f6275a346964bd265e0d60cab267bce0d9db11324136a808c14ef8152b5c533ebb7788b7880d54e2648fc012e6ee58801490971edd72b

    • SSDEEP

      12288:yLgWTG4ma0voAqtWJevyZT6ykN/s+H1Sj4Q2TOvYNttS0e5lv:o7Tb0gAqt7vyppqV04Q2iANttS7z

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks