General

  • Target

    379fe2230917718e3b124ad2950e9e25a1963e79a0c830bb5022bcc319aab25c

  • Size

    666KB

  • Sample

    241008-f3s6ra1cmn

  • MD5

    ac7ebca21c229e33095e4bfec852cd2b

  • SHA1

    01b26661a920b866643e418e16edfc2ae5fb0f53

  • SHA256

    379fe2230917718e3b124ad2950e9e25a1963e79a0c830bb5022bcc319aab25c

  • SHA512

    42fb0cd284759d0d0eba1061550332838ac7a22625fb9613f004c7f3e2e509e1d9417d6fba3a4889853107cbbb2919e0360684ea4b20e79c19f75beda120ca7a

  • SSDEEP

    12288:VopMDjZ0KUYcYH6KXVwDTkxA7ReH6G4331B92Z0+0QOlLkw3EmE:VYMB0UGQVwDMA1eH6G4nLQIQOhNvE

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

hy08

Decoy

weazc.top

servoceimmpajhnuz.info

vqemkdhi.xyz

wergol.com

spa-mk.com

rtpsid88.life

tatetits.fun

raidsa.xyz

suojiansuode.net

jointhejunction.com

wudai.net

typeboot.shop

mksport-app.com

miocloud.ovh

taipan77pandan.com

wwwhg58a.com

khuahamiksai31.pro

carpedatumllc.net

safebinders.com

krx21.com

Targets

    • Target

      379fe2230917718e3b124ad2950e9e25a1963e79a0c830bb5022bcc319aab25c

    • Size

      666KB

    • MD5

      ac7ebca21c229e33095e4bfec852cd2b

    • SHA1

      01b26661a920b866643e418e16edfc2ae5fb0f53

    • SHA256

      379fe2230917718e3b124ad2950e9e25a1963e79a0c830bb5022bcc319aab25c

    • SHA512

      42fb0cd284759d0d0eba1061550332838ac7a22625fb9613f004c7f3e2e509e1d9417d6fba3a4889853107cbbb2919e0360684ea4b20e79c19f75beda120ca7a

    • SSDEEP

      12288:VopMDjZ0KUYcYH6KXVwDTkxA7ReH6G4331B92Z0+0QOlLkw3EmE:VYMB0UGQVwDMA1eH6G4nLQIQOhNvE

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks