General

  • Target
    SWIFT TRANSFER.exe
  • Size 490KB
  • Sample201006-2kfym1f1qn
  • SHA256 ec4ee2fa916e9fc280f06af0ceded7835693723ebbc6c60bd6e371b5d4ad006a
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • formbook

C2
  • http://www.purebodyrecovery.com/rhk/

Decoy
  • decodemethod.com

  • mamakeyfim.xyz

  • 3smokers.com

  • rentaspendirect.com

  • projectstasksjobs.com

  • animedesignetees.com

  • ursthegardennurse.com

  • sunandmoonshirts.com

  • encuentros-es.com

  • nevadahomebirth.com

  • xoxoplants.com

  • tentenos.com

  • anhpham.net

  • beyondtourney.com

  • surfficient.com

  • wannahavedays.online

  • hmyhvgxax.icu

  • holisticskincarecompany.com

  • juggfuckers.com

  • ixgrmz.com

Targets

    • Target
      SWIFT TRANSFER.exe
    • Size 490KB
    • SHA256 ec4ee2fa916e9fc280f06af0ceded7835693723ebbc6c60bd6e371b5d4ad006a
    • MD5 SHA1 SHA512
    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook Payload

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks