General

  • Target
    Estimate from Construction Materials Technologies Pty Ltd.exe
  • Size 541KB
  • Sample201008-e163s81j9s
  • SHA256 205522a02f43a8477a1ed81ea1dff4f5b914afbc01f68ac082e5bf76d73fe8b2
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • formbook

C2
  • http://www.mxmsportsgear.com/dfr/

Decoy
  • sizcabs.com

  • neochempharma.com

  • femuewedrewa.com

  • sedeot.com

  • dstresscafe.com

  • anthemation.com

  • starcmantova.com

  • brainstore1.com

  • karishara.com

  • amelclothing.com

  • shopmarielcosmetics.com

  • shreejeematrimonial.com

  • maggiesurbanfarm.com

  • backmyplay.com

  • taootop.com

  • riad-libitibito.com

  • nandemo-system.com

  • fastpeoesearch.com

  • thekasharab.com

  • 8hapi.com

Targets

    • Target
      Estimate from Construction Materials Technologies Pty Ltd.exe
    • Size 541KB
    • SHA256 205522a02f43a8477a1ed81ea1dff4f5b914afbc01f68ac082e5bf76d73fe8b2
    • MD5 SHA1 SHA512
    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook Payload

    • Deletes itself

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks