General

  • Target
    Profoma_Invoice_SWD173647_3vey_REfR-32JdhY_PDF.exe
  • Size 508KB
  • Sample200811-ddfqtrz35x
  • SHA256 20000a9d0078fa18b60d9ad52d36b4f5dfa77d2f74866e8793ee0085ab0c9964
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • formbook

C2
  • http://www.flekcht.com/f4m/

Decoy
  • orphanshop.net

  • banbietchua.site

  • seafarercanvas.net

  • featherandfurpets.com

  • midaowenhua.com

  • thetonisher.com

  • d2cplaybook.com

  • 26rutlee.com

  • moncriefcomputers.com

  • intouchproducts.net

  • sulkaravelovpd.com

  • lipstickanew.com

  • famous.international

  • lamaisonbleuedelongbois.com

  • hunde-nanny.com

  • bdrdesigngroup.net

  • salesforcemwpchat.com

  • zm67ng9e36.com

  • ohiobaler.net

  • shivacleaning.com

Targets

    • Target
      Profoma_Invoice_SWD173647_3vey_REfR-32JdhY_PDF.exe
    • Size 508KB
    • SHA256 20000a9d0078fa18b60d9ad52d36b4f5dfa77d2f74866e8793ee0085ab0c9964
    • MD5 SHA1 SHA512
    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook Payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks