General

  • Target
    ASQ2109942.exe
  • Size 365KB
  • Sample201016-dc2txmvhes
  • SHA256 a76869f6ece56a889175cb2cebdb60e4a24025184ebeb7fa9c6210668eb023fe
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • formbook

C2
  • http://www.ruartemoyano.com/xnc/

Decoy
  • haitchworks.com

  • 36rn.com

  • cc-js.com

  • godscult.com

  • partypooperlv.com

  • norcalsolarcleaning.com

  • vedatdmr.com

  • bbvau.com

  • abranna.com

  • pools.win

  • baltimoresoftware.com

  • sdafund.com

  • marketinglocal.digital

  • edyta-bober.com

  • uyorku.com

  • boudoirphotographerdallas.com

  • sunshineandcoffeeboutique.com

  • batttleroyaleuk.com

  • 11382.xyz

  • euphoricjewelzz.com

Targets

    • Target
      ASQ2109942.exe
    • Size 365KB
    • SHA256 a76869f6ece56a889175cb2cebdb60e4a24025184ebeb7fa9c6210668eb023fe
    • MD5 SHA1 SHA512
    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook Payload

    • Deletes itself

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks