General

  • Target
    Approved Customize design.exe
  • Size 616KB
  • Sample201015-ykkvb5tgg6
  • SHA256 4368bd3df923b59ec3239a36cfd6cbd4c8aa568ebfaec16433e0a464d368f362
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • formbook

C2
  • http://www.ingfathailand.com/rsu/

Decoy
  • thecrestdallas.com

  • letsbookt.com

  • cyrobio.com

  • gowithmizan.com

  • ekadamy.com

  • hereforassist.com

  • yogacourse.company

  • bookmostlikely.com

  • seasythings.com

  • yourazre.com

  • iconic-ut.com

  • quantemtips.com

  • dtjgxxw.com

  • adagamov.com

  • 7stepsmeal.com

  • iamnicoleschoen.com

  • 410advisory.com

  • 17aia.com

  • eizousai.net

  • oceanbluecandy.com

Targets

    • Target
      Approved Customize design.exe
    • Size 616KB
    • SHA256 4368bd3df923b59ec3239a36cfd6cbd4c8aa568ebfaec16433e0a464d368f362
    • MD5 SHA1 SHA512
    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook Payload

    • Deletes itself

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks