General

  • Target

    8389b3ecce08249b5d4ad5eede18ef1136f4acef3137fcd9fd4850082e090049

  • Size

    661KB

  • Sample

    250119-ep9e5swkhn

  • MD5

    4b1b3a715305efece2e7c37c5346a719

  • SHA1

    d4b0fd026b293bc0131706a49d73db072b0b136c

  • SHA256

    8389b3ecce08249b5d4ad5eede18ef1136f4acef3137fcd9fd4850082e090049

  • SHA512

    18c3eb1dc929b4c7143b2f6b9327b78e6c3cfbbff87216cabbe23de32985e694ba1bcdc5ae737e69472147a4d8d6475fdcd24ffdf4ad1357fef97fb5147335d7

  • SSDEEP

    12288:M6YRxA4Y5lyA/BxSPCNiITWBlyZWuActY/V/5E0bblR+1Y7NyEFcePZCR:URo7Sy4uActY/VFT+EyMZCR

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

3nop

Decoy

subur88wap.sbs

tyai1.top

skillbeast.site

kcclassiccars.net

lghomes.net

eijanno.cyou

work-in-usa-60100.bond

268chill.store

bharatwin.biz

cakjitu01.xyz

misafert.xyz

hiretemp.net

lvekz-onearmed.top

amanda-manopo.info

seo-companies22.online

casinowalletth.net

maynrson.monster

bewizi.com

thedronetechhub.shop

car-insurance-93947.bond

Targets

    • Target

      8389b3ecce08249b5d4ad5eede18ef1136f4acef3137fcd9fd4850082e090049

    • Size

      661KB

    • MD5

      4b1b3a715305efece2e7c37c5346a719

    • SHA1

      d4b0fd026b293bc0131706a49d73db072b0b136c

    • SHA256

      8389b3ecce08249b5d4ad5eede18ef1136f4acef3137fcd9fd4850082e090049

    • SHA512

      18c3eb1dc929b4c7143b2f6b9327b78e6c3cfbbff87216cabbe23de32985e694ba1bcdc5ae737e69472147a4d8d6475fdcd24ffdf4ad1357fef97fb5147335d7

    • SSDEEP

      12288:M6YRxA4Y5lyA/BxSPCNiITWBlyZWuActY/V/5E0bblR+1Y7NyEFcePZCR:URo7Sy4uActY/VFT+EyMZCR

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook family

    • Formbook payload

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks