General

  • Target

    a6d2a47171f9630a8db62eb4001e196dfbad94cf40638e108cc649883d1bc069.exe

  • Size

    621KB

  • Sample

    241205-s8rw4a1kfx

  • MD5

    b631685c5ef9ee26ded25c76ab3eda27

  • SHA1

    03696b36c4838440cf8def9687117745c9edbd19

  • SHA256

    a6d2a47171f9630a8db62eb4001e196dfbad94cf40638e108cc649883d1bc069

  • SHA512

    62fe2308ad1490495ec283027e2f07c7d5179ba9a327791de0b98a5f29db4ea3c721d3866674cedcb4033153ff5515d7f5bdc17d547191519dba70cd1c483134

  • SSDEEP

    12288:tLczRLw1+27aPipUXT8eseyW2dv1WlYpXJk1jJT8CWqpqJ4uSYGExH0z:dctLw1+AaPOUXIjew1Umsj+0q2

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

cu29

Decoy

qidr.shop

usinessaviationconsulting.net

68716329.xyz

nd-los.net

ealthironcladguarantee.shop

oftware-download-69354.bond

48372305.top

omeownershub.top

mall-chilli.top

ajakgoid.online

ire-changer-53482.bond

rugsrx.shop

oyang123.info

azino-forum-pro.online

817715.rest

layman.vip

eb777.club

ovatonica.net

urgaslotvip.website

inn-paaaa.buzz

Targets

    • Target

      a6d2a47171f9630a8db62eb4001e196dfbad94cf40638e108cc649883d1bc069.exe

    • Size

      621KB

    • MD5

      b631685c5ef9ee26ded25c76ab3eda27

    • SHA1

      03696b36c4838440cf8def9687117745c9edbd19

    • SHA256

      a6d2a47171f9630a8db62eb4001e196dfbad94cf40638e108cc649883d1bc069

    • SHA512

      62fe2308ad1490495ec283027e2f07c7d5179ba9a327791de0b98a5f29db4ea3c721d3866674cedcb4033153ff5515d7f5bdc17d547191519dba70cd1c483134

    • SSDEEP

      12288:tLczRLw1+27aPipUXT8eseyW2dv1WlYpXJk1jJT8CWqpqJ4uSYGExH0z:dctLw1+AaPOUXIjew1Umsj+0q2

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook family

    • Formbook payload

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks