General

  • Target
    August P_O.exe
  • Size 531KB
  • Sample200817-ml6vbqrbd6
  • SHA256 404f88f8e5d2270cbab30c8e9de8d30aa8054939580a6ef40f41df59cc1f90a8
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • formbook

C2
  • http://www.ranges-xx.com/g82/

Decoy
  • hqeknj.men

  • keboku.com

  • westofbroadway.net

  • trustbetween.com

  • alpa-dachbeschichtung.com

  • korea-kone.com

  • akira-fukui.com

  • bikehire.net

  • stabilizedliquidoxyen.com

  • thepigeonpea.com

  • myilene.life

  • classroomclosets.com

  • albergodellasalute.com

  • propiedadesok.com

  • gannettinsights.com

  • marie-rae.com

  • essentalgems.com

  • appicot.com

  • lupinpaints.com

  • jizhehua.com

Targets

    • Target
      August P_O.exe
    • Size 531KB
    • SHA256 404f88f8e5d2270cbab30c8e9de8d30aa8054939580a6ef40f41df59cc1f90a8
    • MD5 SHA1 SHA512
    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook Payload

    • Deletes itself

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks