General

  • Target

    df570404d94edaa7ff2945eb4cba6034a77509036cc61fae5ba532b848212453.exe

  • Size

    1.0MB

  • Sample

    241008-cwpm7sthmp

  • MD5

    4ec59c489b7d163befca6d22dfeff7a7

  • SHA1

    df623ce4e0feb7627e48f6dba3a9698d15fbc7b9

  • SHA256

    df570404d94edaa7ff2945eb4cba6034a77509036cc61fae5ba532b848212453

  • SHA512

    c496d08a91579f4918f23a70b3528aa46198d8758e2dc42e97f65ce6be962192d114b64791efdd882f5ccfe9b6714ae279bedd7aa3d28d4eff890d023d1e62ca

  • SSDEEP

    24576:AAHnh+eWsN3skA4RV1Hom2KXMmHa3MyapIT49CJ5:3h+ZkldoPK8Ya3MdpIP

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

e23y

Decoy

stiloeconforto.shop

79nn470gl.autos

ffg.autos

elix-saaac.buzz

tlasbet88win.sbs

inoliga.app

777.fun

avada-ga-3.press

avandakitchen.online

61ep864tr.autos

igitalonlineseva.online

ar-deals-15908.bond

sqqpkv.pro

368i8rnoy.xyz

lxspinsenin.lol

9y204r7eo.sbs

toptalkingaboutit.net

eeplab.xyz

filmyhit.vip

athroom-remodeling-59089.bond

Targets

    • Target

      df570404d94edaa7ff2945eb4cba6034a77509036cc61fae5ba532b848212453.exe

    • Size

      1.0MB

    • MD5

      4ec59c489b7d163befca6d22dfeff7a7

    • SHA1

      df623ce4e0feb7627e48f6dba3a9698d15fbc7b9

    • SHA256

      df570404d94edaa7ff2945eb4cba6034a77509036cc61fae5ba532b848212453

    • SHA512

      c496d08a91579f4918f23a70b3528aa46198d8758e2dc42e97f65ce6be962192d114b64791efdd882f5ccfe9b6714ae279bedd7aa3d28d4eff890d023d1e62ca

    • SSDEEP

      24576:AAHnh+eWsN3skA4RV1Hom2KXMmHa3MyapIT49CJ5:3h+ZkldoPK8Ya3MdpIP

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks