General

  • Target
    Swift Copy.exe
  • Size 490KB
  • Sample201014-q2vpaeflke
  • SHA256 8ce26cc2fb22fe3d89d7f4bd9ea925f0719ff9208b4e37b1f71b9d4e810bcc0c
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • formbook

C2
  • http://www.purebodyrecovery.com/rhk/

Decoy
  • decodemethod.com

  • mamakeyfim.xyz

  • 3smokers.com

  • rentaspendirect.com

  • projectstasksjobs.com

  • animedesignetees.com

  • ursthegardennurse.com

  • sunandmoonshirts.com

  • encuentros-es.com

  • nevadahomebirth.com

  • xoxoplants.com

  • tentenos.com

  • anhpham.net

  • beyondtourney.com

  • surfficient.com

  • wannahavedays.online

  • hmyhvgxax.icu

  • holisticskincarecompany.com

  • juggfuckers.com

  • ixgrmz.com

Targets

    • Target
      Swift Copy.exe
    • Size 490KB
    • SHA256 8ce26cc2fb22fe3d89d7f4bd9ea925f0719ff9208b4e37b1f71b9d4e810bcc0c
    • MD5 SHA1 SHA512
    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook Payload

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks