General

  • Target

    z8eokahasflcrscooplasb.exe

  • Size

    651KB

  • Sample

    241029-g92l5svkhv

  • MD5

    1660c33123052f15e4e63891f23ddd1e

  • SHA1

    3b93eb0499260f494066d6a28f1238c1c440b04f

  • SHA256

    44ab353624b9e867ae31a0523437ed8e321f361d248b471c15bd2902255280f3

  • SHA512

    6c55d8bcfc60d513ae59cae83eb0ec0ee4b740dd0305664f3997fd9758104e79238d8f9304345de94c9b76ed8c6fd03f8e66ab72c9f49d55d8a18b5388b58351

  • SSDEEP

    12288:JMRkVqoYve4eWCRO5W9Se/DETPCvTtQdH41lIaPLLrR:eRkVPP49Ip4ebELCvJQx45V

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

dn13

Decoy

5q53s.top

f9813.top

ysticsmoke.net

ignorysingeysquints.cfd

yncsignature.live

svp-their.xyz

outya.xyz

wlkflwef3sf2wf.top

etterjugfetkaril.cfd

p9eh2s99b5.top

400108iqlnnqi219.top

ynsu-condition.xyz

ndividual-bfiaen.xyz

anceibizamagazine.net

itrussips.live

orkcubefood.xyz

lindsandfurnishings.shop

ajwmid.top

pigramescentfeatous.shop

mbvcv56789.click

Targets

    • Target

      z8eokahasflcrscooplasb.exe

    • Size

      651KB

    • MD5

      1660c33123052f15e4e63891f23ddd1e

    • SHA1

      3b93eb0499260f494066d6a28f1238c1c440b04f

    • SHA256

      44ab353624b9e867ae31a0523437ed8e321f361d248b471c15bd2902255280f3

    • SHA512

      6c55d8bcfc60d513ae59cae83eb0ec0ee4b740dd0305664f3997fd9758104e79238d8f9304345de94c9b76ed8c6fd03f8e66ab72c9f49d55d8a18b5388b58351

    • SSDEEP

      12288:JMRkVqoYve4eWCRO5W9Se/DETPCvTtQdH41lIaPLLrR:eRkVPP49Ip4ebELCvJQx45V

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook family

    • Formbook payload

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks