General

  • Target
    po.no.4414463099.exe
  • Size 623KB
  • Sample201016-ndezhb4pxj
  • SHA256 201e2fd48dfdd75ee8abf1ad910deb3ffa1784ae0229fe7588b2b54119409aee
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • formbook

C2
  • http://www.jsbdistributor.com/u2e/

Decoy
  • aartihand.com

  • texasreloaded.com

  • 2794moraga.com

  • mybcinfo.com

  • wriz.xyz

  • headlundco.com

  • officialangelanichelle.com

  • danielledelaine.com

  • ateliermalibu.com

  • vantaimanhtruong.com

  • zhimazhiyun.com

  • saimeeraservices.com

  • baisongke.com

  • catearhelmet.com

  • palasian.net

  • merchantofzanzibar.com

  • ateliercrepin.com

  • guardtactics.com

  • ceritadata.com

  • nacesiti.com

Targets

    • Target
      po.no.4414463099.exe
    • Size 623KB
    • SHA256 201e2fd48dfdd75ee8abf1ad910deb3ffa1784ae0229fe7588b2b54119409aee
    • MD5 SHA1 SHA512
    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook Payload

    • Deletes itself

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks