General

  • Target
    PAYMENT UPDATE DEBIT NOTEINVOICE NO. SUVI20-0813_PDF.exe
  • Size 604KB
  • Sample200813-rn3kcwk8tx
  • SHA256 464ffb9a16b269537c0b4475ebe897cc2bb1e0e8d35b0da24aaf21d677a5bf02
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • formbook

C2
  • http://www.flekcht.com/f4m/

Decoy
  • orphanshop.net

  • banbietchua.site

  • seafarercanvas.net

  • featherandfurpets.com

  • midaowenhua.com

  • thetonisher.com

  • d2cplaybook.com

  • 26rutlee.com

  • moncriefcomputers.com

  • intouchproducts.net

  • sulkaravelovpd.com

  • lipstickanew.com

  • famous.international

  • lamaisonbleuedelongbois.com

  • hunde-nanny.com

  • bdrdesigngroup.net

  • salesforcemwpchat.com

  • zm67ng9e36.com

  • ohiobaler.net

  • shivacleaning.com

Targets

    • Target
      PAYMENT UPDATE DEBIT NOTEINVOICE NO. SUVI20-0813_PDF.exe
    • Size 604KB
    • SHA256 464ffb9a16b269537c0b4475ebe897cc2bb1e0e8d35b0da24aaf21d677a5bf02
    • MD5 SHA1 SHA512
    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook Payload

    • Deletes itself

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks