General

  • Target

    8b24936157cae59842c62804dd53988ac0e13a8ae3d1b7ba9500942a608fb451

  • Size

    710KB

  • Sample

    241005-pd2w2asglm

  • MD5

    19a43363822338c4a87fd7403c43fed4

  • SHA1

    3ba5b289d064adfcb73e92c1444e7b60b7929fa0

  • SHA256

    8b24936157cae59842c62804dd53988ac0e13a8ae3d1b7ba9500942a608fb451

  • SHA512

    52a2bfa22e93cc0daee661bc7d6eaf6617ba6da71588a51c163c01703d43aeb4f638d7e986acfcb06d160572af16c7dcd7c4003a8ef2482c3a77cc1a6802a63e

  • SSDEEP

    12288:d11cKNr+u995CVlp1zO0G2EqloCUegenGTGFN1HXPZZFys1aygQGJ:9bCuXiLzO0jloCmeGSFN13PdaQ

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

cr12

Decoy

nff1291.com

satyainfra.com

hechiceradeamores.com

jfgminimalist.com

qut68q.com

pedandmore.com

sugardefender24-usa.us

somalse.com

lotusluxecandle.com

certificadobassetpro.com

veryaroma.com

thehistoryofindia.in

33155.cc

terastudy.net

84031.vip

heilsambegegnen.com

horizon-rg.info

junongpei.website

winstons.club

henslotalt.us

Targets

    • Target

      8b24936157cae59842c62804dd53988ac0e13a8ae3d1b7ba9500942a608fb451

    • Size

      710KB

    • MD5

      19a43363822338c4a87fd7403c43fed4

    • SHA1

      3ba5b289d064adfcb73e92c1444e7b60b7929fa0

    • SHA256

      8b24936157cae59842c62804dd53988ac0e13a8ae3d1b7ba9500942a608fb451

    • SHA512

      52a2bfa22e93cc0daee661bc7d6eaf6617ba6da71588a51c163c01703d43aeb4f638d7e986acfcb06d160572af16c7dcd7c4003a8ef2482c3a77cc1a6802a63e

    • SSDEEP

      12288:d11cKNr+u995CVlp1zO0G2EqloCUegenGTGFN1HXPZZFys1aygQGJ:9bCuXiLzO0jloCmeGSFN13PdaQ

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks