General

  • Target

    Invoice & Packing list For Sea Shipment.exe

  • Size

    1.0MB

  • Sample

    241023-rxelysvema

  • MD5

    c1bca0dbb6e614a1f38efdba926db82d

  • SHA1

    94addf2011056281afcd7425657d76e760d77bad

  • SHA256

    1ae734d22270bb261f984838e51a77bc5f32be08ac895157ac2691d042fa6dc3

  • SHA512

    f87413ff19892c14bca5089a9bb183fd10aad25c87effcccc0c0d1b46cdf5b724a487580cf55e08cf0c2b15f060ac3ea3e0a9fb144559b68cddf2d9c62a13956

  • SSDEEP

    24576:ffmMv6Ckr7Mny5QLiIuTVm4iGEvDuOPcg0B:f3v+7/5QLoTVoGb

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

ge07

Decoy

amyard.shop

eloshost.xyz

g18q11a.top

orensic-vendor-735524320.click

ithin-ksvodn.xyz

xhyx.top

elonix-traceglow.pro

cillascrewedsedroth.cfd

wner-nyquh.xyz

reyhazeusa.shop

esmellretaperetotal.cfd

hqm-during.xyz

pipagtxcorrelo.xyz

lray-civil.xyz

apybarameme.xyz

rbuds.shop

hild-fcudh.xyz

rkgexg.top

estwestcottwines.shop

giyztm.xyz

Targets

    • Target

      Invoice & Packing list For Sea Shipment.exe

    • Size

      1.0MB

    • MD5

      c1bca0dbb6e614a1f38efdba926db82d

    • SHA1

      94addf2011056281afcd7425657d76e760d77bad

    • SHA256

      1ae734d22270bb261f984838e51a77bc5f32be08ac895157ac2691d042fa6dc3

    • SHA512

      f87413ff19892c14bca5089a9bb183fd10aad25c87effcccc0c0d1b46cdf5b724a487580cf55e08cf0c2b15f060ac3ea3e0a9fb144559b68cddf2d9c62a13956

    • SSDEEP

      24576:ffmMv6Ckr7Mny5QLiIuTVm4iGEvDuOPcg0B:f3v+7/5QLoTVoGb

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks