General

  • Target

    bb8f23c39f4b98eb90c4686efbf77cae0453f1a0a7d51dc46087f1656e0a0e03

  • Size

    694KB

  • Sample

    241027-vq38hsxmdm

  • MD5

    3e32da76dca96074f9b0425c30f65c3b

  • SHA1

    a03713b45c65ba15d251fa6931c43111f41021ef

  • SHA256

    bb8f23c39f4b98eb90c4686efbf77cae0453f1a0a7d51dc46087f1656e0a0e03

  • SHA512

    91c049de553110ad4e2ed0a7362d5479c80067b95b0ae0540ff5ba1bec2cd088acbfbbbf3a9ec2573862f2c7afbb65826e125d7e1d7ae10bca433912ae8f44ce

  • SSDEEP

    12288:Blwq7sJyQA6cHVsC8UWRQfJHaviuYMqXXhOf/kFNFUKXZzjvHS/B:L9sJyQALHVsC8UFbNhXRWKuAvwB

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

m25s

Decoy

araghospitality.net

cleans.xyz

olnacasinotcs14.top

pringhillinfos.net

erkakasrumah.online

orean-course-289113002.zone

yeloma-treatment-82106.bond

76iw543gw.autos

nline-shopping-56055.bond

enetik.xyz

ax-th-6011838.fyi

itygatehousing.app

23zy998jk.bond

pslag-hal-2.online

uykoii.shop

9supjub3p.buzz

tmgl.bond

actus-catering-creations.net

ntercashspace24.homes

ierra777.vip

Targets

    • Target

      Bank slip.exe

    • Size

      813KB

    • MD5

      cd9e659d35f3995b5ab1760c10800ae2

    • SHA1

      3376e44af32ceeac22323d41925f84eade837c81

    • SHA256

      1afa322c6a3e0964c704f0d7aea78fe5d506c4bbff033f26f0fe6abc8f88c9cd

    • SHA512

      db1158a6aaf1fe8d00f0fa9b3a4aeddf60b56cbc241e903f5cc7f74f6c311691eeb2e704c6297aefc51bf317fd96acab3ac927bb954a7ab4fbd836a36cd303d2

    • SSDEEP

      12288:+t2iNtXWgGIJeQAIpel315kiev0r4Cu+9It6vcmLXfXS/XnLFZOqrM2zvIAnF:+t16gOmelFZuUkLXnWqo

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook family

    • Formbook payload

    • Deletes itself

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks