General

  • Target

    01c879fb6063308d10f1958803f5633b.bin

  • Size

    564KB

  • Sample

    241114-bcpnesvrgp

  • MD5

    efc10268a90ef3292d5677ede421930b

  • SHA1

    e07e9d33b81f9247b7074bfeebf23f91ba680dfe

  • SHA256

    093a6b624219e576a0010b3dd4470faaec5dfd2d81a3419e5f8b6fd9dce7db3e

  • SHA512

    ee42c5e4131c94115782a0d0ade390c1f87328305b89c5e9c9b9266d04fb31e19666c81cc4d87e52b3d28e31f9a4d0d0a1797f8d6e36e1cdf068d1462affeb25

  • SSDEEP

    12288:Phf020m3Zzi3+98/Qq04INenZckkyO5RGzS9wAcoa1D9PqZPbG:PZ0lE8/QvNenZPkJ+zS9ZK1D9MPbG

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

m17o

Decoy

kzqh72.top

arket-obybqq.xyz

afechoice.click

ote-knplpa.xyz

aqgpie.xyz

orker-ornp.xyz

he-beds321.today

ut-nlvv.xyz

31231827.xyz

milymariephotography.net

wquqo.click

veu-where.xyz

mjcpo-pick.xyz

yself-lpnbdl.xyz

austoowagosha.net

ive-wgag.xyz

lay-drift-palace.xyz

old-vubgv.xyz

ideo-shooting-courses.today

ntendsisaiasjazmin.shop

Targets

    • Target

      4a78c8f9b9321dd93c0e1c9e325271c434aa194d67e9d63b73c66c054d44049f.exe

    • Size

      586KB

    • MD5

      01c879fb6063308d10f1958803f5633b

    • SHA1

      691d2833dcc4a2a1f2e8f746f3f9bb5ceaf8cf33

    • SHA256

      4a78c8f9b9321dd93c0e1c9e325271c434aa194d67e9d63b73c66c054d44049f

    • SHA512

      f1fb9fef3108c04fa893111da8c4e52b893a22ddc4cc18f135774c04fe6f0b90e52a87fe251fe0d2f93df9a508dd4f1bdc687dbbe67103a919675cd87bd074de

    • SSDEEP

      12288:U0nsD80+C/vmwf3PR7alWqgvZSmFiG92PfVGDr5Oi:3nR4/Zf57al1g192gDr5O

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook family

    • Formbook payload

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks