General

  • Target
    Fatura_Um0slpC3IsVAmnv.exe
  • Size 594KB
  • Sample201005-tm8sneaqdx
  • SHA256 00c31ece69362a5cccc665bc1d57b48240d5bf53cbb159cb72b26454849e798e
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • formbook

C2
  • http://www.chsepd.com/agwz/

Decoy
  • organicsifa.com

  • microlivros.com

  • kharestudio.com

  • processautomationsystem.com

  • 359192.com

  • user-id06783.com

  • hoopletesonline.com

  • camrashos.com

  • xfgyzzm.icu

  • jjjllcbooking.com

  • ztouh.info

  • mynetlfis.info

  • honeydigi.com

  • claytelier.com

  • hbozoom.com

  • theleftreports.net

  • drmenelaou.com

  • ignoringracism.com

  • querofalardesaude.com

  • smithysminicharters.com

Targets

    • Target
      Fatura_Um0slpC3IsVAmnv.exe
    • Size 594KB
    • SHA256 00c31ece69362a5cccc665bc1d57b48240d5bf53cbb159cb72b26454849e798e
    • MD5 SHA1 SHA512
    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook Payload

    • Deletes itself

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks