General

  • Target
    52f37f9c800ae0bef724c76c69d44b5b.exe
  • Size 778KB
  • Sample200902-9kn8rpwlze
  • SHA256 46c1beb680fee0894d6a58d53ee86faeb9dfa24db88f178580dfbd1385e4c581
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • formbook

C2
  • http://www.masion2.info/u6ga/

Decoy
  • bsignatureenterprises.com

  • hindu.love

  • freegeneratorforall.com

  • greenpeasandlove.com

  • issvnews.com

  • conversationsforyoursoul.com

  • 33efe.com

  • hypnosisatlanta.info

  • publicsectorpress.com

  • naturestruessence.net

  • xn--90ais8bzae.xn--p1acf

  • pemenangshopee.com

  • assassinspaintball.com

  • canna.homes

  • howtocodeinjs.com

  • davewescon.com

  • qualitheory.com

  • milashpro.com

  • yayazshops.com

  • bomei138.com

Targets

    • Target
      52f37f9c800ae0bef724c76c69d44b5b.exe
    • Size 778KB
    • SHA256 46c1beb680fee0894d6a58d53ee86faeb9dfa24db88f178580dfbd1385e4c581
    • MD5 SHA1 SHA512
    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook Payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks