General

  • Target

    Invoice Packing list For Sea Shipment.exe

  • Size

    1.0MB

  • Sample

    241022-qgefksydrj

  • MD5

    ec2c603cc2d1551fa4340019e93415a6

  • SHA1

    07fbc2fd5fba763042c3765e62320560aad87e72

  • SHA256

    4184b14006520ea167252e0264bcd92873ea365635baaed4d366a4aaf9e32e8b

  • SHA512

    13aff89c23a5bfb0218b7c46e4ba25b3cb2a91636d808cf5345d2df5b600414b0c3273cee835b5da984d1bf120489ede1091fd686db9e7edd551348f0e22c42a

  • SSDEEP

    24576:ffmMv6Ckr7Mny5QLPUqPRnCHBGvBYluJqWg:f3v+7/5QLPUqpnCHBGSluJHg

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

ge07

Decoy

amyard.shop

eloshost.xyz

g18q11a.top

orensic-vendor-735524320.click

ithin-ksvodn.xyz

xhyx.top

elonix-traceglow.pro

cillascrewedsedroth.cfd

wner-nyquh.xyz

reyhazeusa.shop

esmellretaperetotal.cfd

hqm-during.xyz

pipagtxcorrelo.xyz

lray-civil.xyz

apybarameme.xyz

rbuds.shop

hild-fcudh.xyz

rkgexg.top

estwestcottwines.shop

giyztm.xyz

Targets

    • Target

      Invoice Packing list For Sea Shipment.exe

    • Size

      1.0MB

    • MD5

      ec2c603cc2d1551fa4340019e93415a6

    • SHA1

      07fbc2fd5fba763042c3765e62320560aad87e72

    • SHA256

      4184b14006520ea167252e0264bcd92873ea365635baaed4d366a4aaf9e32e8b

    • SHA512

      13aff89c23a5bfb0218b7c46e4ba25b3cb2a91636d808cf5345d2df5b600414b0c3273cee835b5da984d1bf120489ede1091fd686db9e7edd551348f0e22c42a

    • SSDEEP

      24576:ffmMv6Ckr7Mny5QLPUqPRnCHBGvBYluJqWg:f3v+7/5QLPUqpnCHBGSluJHg

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks