General

  • Target

    b2f6924210cfad56a2bbf5a0701684602693a525c68abdbebdb7cea1d106eb30.exe

  • Size

    1.0MB

  • Sample

    241017-cnkpaazhkl

  • MD5

    2df19cbed6783bb46abc5ef62529f920

  • SHA1

    6afc895cef6f1fff5b866a5fdf35fe6f77ac435e

  • SHA256

    b2f6924210cfad56a2bbf5a0701684602693a525c68abdbebdb7cea1d106eb30

  • SHA512

    11cad11748b8a3cb7caabe8ea81adfe0ceef5907825938ec62f69bcd4456c4d8ca461ec4af4b7a1c6a34a10754e11cc8b907170e5f5a5e2b32a672ec6e449bae

  • SSDEEP

    24576:ffmMv6Ckr7Mny5QLeeba0f7saTpemGiLH:f3v+7/5QLjocpair

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

ge07

Decoy

amyard.shop

eloshost.xyz

g18q11a.top

orensic-vendor-735524320.click

ithin-ksvodn.xyz

xhyx.top

elonix-traceglow.pro

cillascrewedsedroth.cfd

wner-nyquh.xyz

reyhazeusa.shop

esmellretaperetotal.cfd

hqm-during.xyz

pipagtxcorrelo.xyz

lray-civil.xyz

apybarameme.xyz

rbuds.shop

hild-fcudh.xyz

rkgexg.top

estwestcottwines.shop

giyztm.xyz

Targets

    • Target

      b2f6924210cfad56a2bbf5a0701684602693a525c68abdbebdb7cea1d106eb30.exe

    • Size

      1.0MB

    • MD5

      2df19cbed6783bb46abc5ef62529f920

    • SHA1

      6afc895cef6f1fff5b866a5fdf35fe6f77ac435e

    • SHA256

      b2f6924210cfad56a2bbf5a0701684602693a525c68abdbebdb7cea1d106eb30

    • SHA512

      11cad11748b8a3cb7caabe8ea81adfe0ceef5907825938ec62f69bcd4456c4d8ca461ec4af4b7a1c6a34a10754e11cc8b907170e5f5a5e2b32a672ec6e449bae

    • SSDEEP

      24576:ffmMv6Ckr7Mny5QLeeba0f7saTpemGiLH:f3v+7/5QLjocpair

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks