Resubmissions

04-10-2024 13:00

241004-p8w92avgjp 10

04-10-2024 12:56

241004-p6bwbayhqa 10

General

  • Target

    DF20230706CFW07L.exe

  • Size

    1.1MB

  • Sample

    241004-p8w92avgjp

  • MD5

    41a8e104259af538bf7743d979f9fc32

  • SHA1

    f69fc5cb7a6401e345a5570e9041ba180faeaad5

  • SHA256

    e4bd5a51df8c1a437dda0ea6d067f61c897034f8e274e1cf1d1ffa5b931816c2

  • SHA512

    1ea7c153b93f4b9607e3e046dcf0bd270b0bc769417287c8edd6f421590e41cd871492ae738947d8a3122a3185a8805eac738c0d80ee18b0aceef8b2ce3acff0

  • SSDEEP

    12288:JLkcoxg7v3qnC11ErwIhh0F4qwUgUny5QNJPiDGJE1kDHrtr7PDrfrxolemd6vNB:NfmMv6Ckr7Mny5QNJK6JWEL1TOleme

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

e62s

Decoy

ellinksa.shop

uckyspinph.xyz

owdark.net

arriage-therapy-72241.bond

w7ijko4rv4p97b.top

heirbuzzwords.buzz

aspart.shop

ctivemail5-kagoya-com.info

shacertification9.shop

zitcd65k3.buzz

llkosoi.info

ru8.info

rhgtrdjdjykyetrdjftd.buzz

yschoollist.kiwi

oftfolio.online

rograma-de-almacen-2.online

oudoarms.top

mwquas.xyz

orjagaucha.website

nlinechat-mh.online

Targets

    • Target

      DF20230706CFW07L.exe

    • Size

      1.1MB

    • MD5

      41a8e104259af538bf7743d979f9fc32

    • SHA1

      f69fc5cb7a6401e345a5570e9041ba180faeaad5

    • SHA256

      e4bd5a51df8c1a437dda0ea6d067f61c897034f8e274e1cf1d1ffa5b931816c2

    • SHA512

      1ea7c153b93f4b9607e3e046dcf0bd270b0bc769417287c8edd6f421590e41cd871492ae738947d8a3122a3185a8805eac738c0d80ee18b0aceef8b2ce3acff0

    • SSDEEP

      12288:JLkcoxg7v3qnC11ErwIhh0F4qwUgUny5QNJPiDGJE1kDHrtr7PDrfrxolemd6vNB:NfmMv6Ckr7Mny5QNJK6JWEL1TOleme

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks