General

  • Target
    orden de compra.exe
  • Size 380KB
  • Sample200814-sbeft2w49s
  • SHA256 2f9d83d844287396dcaf52b5c15c1dacc92bc4ae2e2777d24c8d09465037ace3
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • formbook

C2
  • http://www.fex-tracks.com/kvsz/

Decoy
  • okashyns.com

  • sbsgamedaejeon-two.com

  • drb77.com

  • top5dating.com

  • websprings.online

  • voizers.com

  • zenith.site

  • lahistoriade.com

  • qv85.com

  • armandonieto.com

  • priestvedic.com

  • jessandjeff.net

  • magic-desktop.com

  • jitaji.com

  • ldmeili.com

  • yuwanqingmy.com

  • buzhouorg.com

  • chaiseloungereviews.com

  • m2g8way.com

  • freespin-support.com

Targets

    • Target
      orden de compra.exe
    • Size 380KB
    • SHA256 2f9d83d844287396dcaf52b5c15c1dacc92bc4ae2e2777d24c8d09465037ace3
    • MD5 SHA1 SHA512
    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook Payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks