General

  • Target

    237331c635e7f438708640a14f30c41682edd9a564be849f93e69fcb6b1bf8bb

  • Size

    548KB

  • Sample

    241018-y1frraxhnj

  • MD5

    1b56659541eda1c92760b6b992eaee12

  • SHA1

    8afd84f2691b4e221becc377606b3e66e667009d

  • SHA256

    237331c635e7f438708640a14f30c41682edd9a564be849f93e69fcb6b1bf8bb

  • SHA512

    8c82c207ba397cf96e49c122382ba3d25e9d8f34fad6e7af11c82378c275793bbec19a9bdc71c7e1b98f2ccffea7d4ca8f88a393d1bff78b42160c18f4866ebc

  • SSDEEP

    12288:H/l/PGi8K20h156Mu8lAl1sVsmyV1b/I0iW1M5dizQx7n4vLF:Hd/Pt8K20jlujsVsRV1bF3wsQxz4zF

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

m25s

Decoy

araghospitality.net

cleans.xyz

olnacasinotcs14.top

pringhillinfos.net

erkakasrumah.online

orean-course-289113002.zone

yeloma-treatment-82106.bond

76iw543gw.autos

nline-shopping-56055.bond

enetik.xyz

ax-th-6011838.fyi

itygatehousing.app

23zy998jk.bond

pslag-hal-2.online

uykoii.shop

9supjub3p.buzz

tmgl.bond

actus-catering-creations.net

ntercashspace24.homes

ierra777.vip

Targets

    • Target

      Final Invoice.exe

    • Size

      606KB

    • MD5

      4fa3f3624a3535393363d37419418907

    • SHA1

      c52af732e90fa8c072eec07eaddaf628a45527f2

    • SHA256

      b3726b579721d786a7288e99dfc1460fff597c9474456fbae59145f8a31fb7ef

    • SHA512

      7802a2dcf488db321a7eb3b0eea98dac49146726b47746b4e8b49374c7ab99c7a842be23354a64d41e3a79f29b6268b71c28e584a42685a22b80b88e1a56fbe8

    • SSDEEP

      12288:ZMaDUR4900fOE2QSP6Mu8DAl7sVymOrMNSl6YY1PpXjf49xi+C/qB:AOYjuNsVyDr611PpAC/

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks