General

  • Target

    c9cda854c8c9a3d895dfdca22ae0a01cfe29f666253af442c08f2a24d871f7ae.uue

  • Size

    918KB

  • Sample

    250116-dzd7ba1kal

  • MD5

    695b19ac7475755bf33b94cbbc4b20bb

  • SHA1

    6f987dc2b08b9e4c0991276c2adbda9f9de3ba23

  • SHA256

    c9cda854c8c9a3d895dfdca22ae0a01cfe29f666253af442c08f2a24d871f7ae

  • SHA512

    f002ff3e745a8a6a826cb0c57281ca03c1132a79c0357518874835742d3fbdbdbe8cf47e34c9a3dce2ec594f1df75b5f0cf48b4037ae0d2dc5b1ac72bc9a46b1

  • SSDEEP

    24576:rMKK0aXHamESbMZE+AwnBkzMD/iTuGxOHSoOJXrBjWo9cA20S6:rM30xmESwZE8brRKOAFtto0r

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

bs84

Decoy

ehuatang.quest

mart-healthcare.solutions

arehouse-inventory-59593.bond

rumpjokes.net

oonlightshadow.store

odernoob.website

sdmedia.net

0k21l6z.xyz

kwovenart.shop

chvb.bid

06ks28.buzz

grexvc.online

unnycdn02.shop

ettingitgonejunk.net

lubmango.store

ustjump.xyz

ofiveuss.store

aahasti-inter5.rest

etclcg.business

ai365.xyz

Targets

    • Target

      RFQ_BID LET-PO#772917811_PROPOSL_BG_AD....PDF.exe

    • Size

      1.4MB

    • MD5

      289754998d1520e2bec7190452c464ac

    • SHA1

      a25755aa21ff2512d7f0b19af804c7ca81729767

    • SHA256

      dd82f88cdd4a62e9e9b5a081cbd3f98b542614ee6b0e33c2385817af92c704a1

    • SHA512

      03e640719eee50a99cdcfce411c940339d5f0142beb4eba5d081a9ac493059fc44be9971f1e78750584cff478941f04c6ea3d61468f8dd903a6636324353ab08

    • SSDEEP

      24576:3qDEvCTbMWu7rQYlBQcBiT6rprG8a1pSsnwcKYQkZrUEI5DafK:3TvC/MTQYxsWR7a1Isn+k6EI

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook family

    • Formbook payload

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks