General

  • Target
    ORDER#08182020.exe
  • Size 559KB
  • Sample200818-y1dq7xtdqa
  • SHA256 ec24550a9fa2fdb2a0e7c739b9ac97387925808dbd832b11675f18e48a93bcc5
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • formbook

C2
  • http://www.regulars6.com/zaer/

Decoy
  • lipbombed.com

  • abmeadors-insurance.biz

  • devtechsolar.com

  • austin-roofingcontractor.com

  • makavelioffspring.com

  • sredalab.com

  • attractionvideo.com

  • designmouldingterrain.com

  • nicerecipes15.info

  • gdclosalcores.com

  • jesussaysyesorno.online

  • forpleasantsleep.com

  • cynthiascountrystore.com

  • thedisinsiderbeta.com

  • dushixue.com

  • eveitis.com

  • huyue-jixie.com

  • buoyantcoin.com

  • london-security-shutters.com

  • fokusworld.com

Targets

    • Target
      ORDER#08182020.exe
    • Size 559KB
    • SHA256 ec24550a9fa2fdb2a0e7c739b9ac97387925808dbd832b11675f18e48a93bcc5
    • MD5 SHA1 SHA512
    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook Payload

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks