General

  • Target
    New Purchase Order 50,689$.exe
  • Size 534KB
  • Sample201010-4bcp9rs5je
  • SHA256 7743197c71f1c9ae348ca9d594840701835941008ea784deef3eec32b3bc734b
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • formbook

C2
  • http://www.touchtoby.xyz/eao/

Decoy
  • littletram.com

  • vanmetaal.com

  • clubbingspringbreak.com

  • intohuman.com

  • steph.place

  • ipsumksa.com

  • paultoon.com

  • wocwebowecbweogw.com

  • beverlyhillsmerch.com

  • vans-athens.com

  • stylishnailsbyem.com

  • milletvit.com

  • pappyjacksburgershack.com

  • anal-liza.com

  • lotownerbuilders.com

  • caffinatics.com

  • cvbtrading.co.uk

  • pheasanttrailsgolfcourse.com

  • wed0888.com

  • sundeepm.com

Targets

    • Target
      New Purchase Order 50,689$.exe
    • Size 534KB
    • SHA256 7743197c71f1c9ae348ca9d594840701835941008ea784deef3eec32b3bc734b
    • MD5 SHA1 SHA512
    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook Payload

    • Deletes itself

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks