General

  • Target

    5181d780e379847bccf22e5cc55b1bdef5c390b78812fb555fb68f042400fd3e.exe

  • Size

    603KB

  • Sample

    241114-cwrskawrar

  • MD5

    dd1fe024a94e2a33b1faa7b03d1c1988

  • SHA1

    315a3c3daf9da89cc8993c85302d0d284f1503ea

  • SHA256

    5181d780e379847bccf22e5cc55b1bdef5c390b78812fb555fb68f042400fd3e

  • SHA512

    185818b975ca406fb9b73f097fbdfd67ee5293f31174a18de22a55310c2f87323d9c2c168651d6fb3169e7587c126b999b8b556a211d56ffef7e52b48ab929ae

  • SSDEEP

    12288:YMyCmE+jjMD0fp77MHyT+XnI2aOkqQr8XSqN714ITNV1oDJIxU:YMyPjMIfxMkgI/1qW8DvBoDmx

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

m17o

Decoy

kzqh72.top

arket-obybqq.xyz

afechoice.click

ote-knplpa.xyz

aqgpie.xyz

orker-ornp.xyz

he-beds321.today

ut-nlvv.xyz

31231827.xyz

milymariephotography.net

wquqo.click

veu-where.xyz

mjcpo-pick.xyz

yself-lpnbdl.xyz

austoowagosha.net

ive-wgag.xyz

lay-drift-palace.xyz

old-vubgv.xyz

ideo-shooting-courses.today

ntendsisaiasjazmin.shop

Targets

    • Target

      5181d780e379847bccf22e5cc55b1bdef5c390b78812fb555fb68f042400fd3e.exe

    • Size

      603KB

    • MD5

      dd1fe024a94e2a33b1faa7b03d1c1988

    • SHA1

      315a3c3daf9da89cc8993c85302d0d284f1503ea

    • SHA256

      5181d780e379847bccf22e5cc55b1bdef5c390b78812fb555fb68f042400fd3e

    • SHA512

      185818b975ca406fb9b73f097fbdfd67ee5293f31174a18de22a55310c2f87323d9c2c168651d6fb3169e7587c126b999b8b556a211d56ffef7e52b48ab929ae

    • SSDEEP

      12288:YMyCmE+jjMD0fp77MHyT+XnI2aOkqQr8XSqN714ITNV1oDJIxU:YMyPjMIfxMkgI/1qW8DvBoDmx

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook family

    • Formbook payload

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks