General

  • Target
    SKM120945.exe
  • Size 436KB
  • Sample201015-9rc47zhb3j
  • SHA256 e85ece3cee51156974c3fb8f0e2c707dae2b51b0d2db9e5fb10531d2fdd76ca6
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • formbook

C2
  • http://www.ruartemoyano.com/xnc/

Decoy
  • haitchworks.com

  • 36rn.com

  • cc-js.com

  • godscult.com

  • partypooperlv.com

  • norcalsolarcleaning.com

  • vedatdmr.com

  • bbvau.com

  • abranna.com

  • pools.win

  • baltimoresoftware.com

  • sdafund.com

  • marketinglocal.digital

  • edyta-bober.com

  • uyorku.com

  • boudoirphotographerdallas.com

  • sunshineandcoffeeboutique.com

  • batttleroyaleuk.com

  • 11382.xyz

  • euphoricjewelzz.com

Targets

    • Target
      SKM120945.exe
    • Size 436KB
    • SHA256 e85ece3cee51156974c3fb8f0e2c707dae2b51b0d2db9e5fb10531d2fdd76ca6
    • MD5 SHA1 SHA512
    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook Payload

    • Deletes itself

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks