Resubmissions

03-10-2024 10:47

241003-mvlj9szhmg 10

03-10-2024 10:20

241003-mc6sgszgjf 10

General

  • Target

    BonificoPagamento1032024pdf.zip

  • Size

    651KB

  • Sample

    241003-mc6sgszgjf

  • MD5

    5c0f239c3af32d44662c1602a0468760

  • SHA1

    f43913e1af5300db9cc290c075627fba3bf56164

  • SHA256

    d436ae7992deb5d1f4a8277d499a45449e647610f33814677f5aae366b1525d9

  • SHA512

    4e0d36517a428d074c2532c91f62a35547af31906e4ed08612952bb57bcf1227450d3514b4bd7b4fb5bfedc5adc548224557d1361339ada764eeecb1b10f8759

  • SSDEEP

    12288:p72iiRtIt4JmVUNZdNk4pa5nRRqgPANRDwAb5C1KkR1nNiRrVaYN:p7ytuON/NkKSRRFAN5wA3cnNiRrJN

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

e23y

Decoy

stiloeconforto.shop

79nn470gl.autos

ffg.autos

elix-saaac.buzz

tlasbet88win.sbs

inoliga.app

777.fun

avada-ga-3.press

avandakitchen.online

61ep864tr.autos

igitalonlineseva.online

ar-deals-15908.bond

sqqpkv.pro

368i8rnoy.xyz

lxspinsenin.lol

9y204r7eo.sbs

toptalkingaboutit.net

eeplab.xyz

filmyhit.vip

athroom-remodeling-59089.bond

Targets

    • Target

      Bonifico Pagamento1032024pdf.exe

    • Size

      1.0MB

    • MD5

      02b3fa038b7489af0c95067a0bed6eda

    • SHA1

      5c6f4be028ca1eb8dada9d627bf3b2e58c6058cc

    • SHA256

      0c3b74467b8178fcd51e50b037df967eb1f9a16bc0f0fcfe3379241fa9edd00f

    • SHA512

      8afb9aabf3065b728198ff1ac5a221bc7f053ceaf8c4538962299383d52646a6b0bff0481a8e66158354811b2c6582119e1b5d85d705ca97c5e0d176effdb410

    • SSDEEP

      24576:jAHnh+eWsN3skA4RV1Hom2KXMmHaWywAN0nNgfnC75:uh+ZkldoPK8YaWyUiK

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks