General

  • Target

    9bed7abc83b78434c8423a380739d28aefdb7dd445f4cf8d3894991de7c79c16.exe

  • Size

    777KB

  • Sample

    241011-klfljszcqr

  • MD5

    8ae2e7fbf45a305d88df997fdc957eee

  • SHA1

    9c7147640143c52435e42f97dad47f768f4c72d4

  • SHA256

    9bed7abc83b78434c8423a380739d28aefdb7dd445f4cf8d3894991de7c79c16

  • SHA512

    7f24ffd64e1a5e30b8f26c3614b5692a15d468a7ac6e12e7f2cbcc810e61d4395238381333f5231d5afe55e5544980c4c26c68a8fa1c34be259b76ede3c534ff

  • SSDEEP

    24576:dEI89rVbCx3YNKc6RgoUzMUlbTqDbwvaj3rm:Q9lCy8gobUlbTIdj3r

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

t94g

Decoy

32188.top

mergencyroofrepair656460.online

jkahu.fun

ur4.autos

r0lba4cl0qkaws8.bond

eiliaowang.top

urjav.xyz

kidaman15.click

old-removal-p350.today

levatethismedia.info

h33323s40.top

dormy.click

5406.club

earlofwisdombook.pro

6980.app

ellwood999.biz

otdates.lol

164v.shop

thereal.app

takeget.online

Targets

    • Target

      9bed7abc83b78434c8423a380739d28aefdb7dd445f4cf8d3894991de7c79c16.exe

    • Size

      777KB

    • MD5

      8ae2e7fbf45a305d88df997fdc957eee

    • SHA1

      9c7147640143c52435e42f97dad47f768f4c72d4

    • SHA256

      9bed7abc83b78434c8423a380739d28aefdb7dd445f4cf8d3894991de7c79c16

    • SHA512

      7f24ffd64e1a5e30b8f26c3614b5692a15d468a7ac6e12e7f2cbcc810e61d4395238381333f5231d5afe55e5544980c4c26c68a8fa1c34be259b76ede3c534ff

    • SSDEEP

      24576:dEI89rVbCx3YNKc6RgoUzMUlbTqDbwvaj3rm:Q9lCy8gobUlbTIdj3r

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks