General

  • Target
    af02d7120e0060d42064f98a12bad0bb.exe
  • Size 438KB
  • Sample201008-v22hb2xa96
  • SHA256 ebd88634ecfbdc7e88bca32a0b22fa35e24c9feb309799128f3d12d2cceac224
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • formbook

C2
  • http://www.strivefalcon.com/c233/

Decoy
  • habittudes.com

  • alfud.com

  • greenzwjh.com

  • firebreez.com

  • elmejortoldodecanarias.com

  • miramelfruits.com

  • kamalunacollective.com

  • petitpaul.art

  • houw.info

  • agilitysystem.net

  • briandnewby.com

  • tijancompound.com

  • rxefills.com

  • omesatr.com

  • funghs0.com

  • fumoebrace.com

  • agusrachmanto.xyz

  • fingerofsunshine.com

  • hzitta.com

  • franomista.com

Targets

    • Target
      af02d7120e0060d42064f98a12bad0bb.exe
    • Size 438KB
    • SHA256 ebd88634ecfbdc7e88bca32a0b22fa35e24c9feb309799128f3d12d2cceac224
    • MD5 SHA1 SHA512
    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook Payload

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks