General

  • Target
    RFQ#116236SO#929198.exe
  • Size 822KB
  • Sample201019-ahv6bmthd2
  • SHA256 e232dc56a916d659961271caf129b47c5fa561f71ecff17f6c96801cd7b50820
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • formbook

C2
  • http://www.squirewatchbands.com/vrf/

Decoy
  • emarketer.xyz

  • erinandrobert2021.com

  • naturalfemina.com

  • brittanyhertz.com

  • wwwtravelblocks.com

  • datilerabotique.com

  • termoindustrias.com

  • kilameq.info

  • cdmcigar.com

  • 2vnt33.com

  • greatstape.com

  • johannahshaven.com

  • avishparalkar.net

  • jdjmijou.club

  • kechevere.com

  • blackstonedynamics.com

  • bomoolah.com

  • creditomedico.com

  • zerongjd.com

  • nyysnkee.com

Targets

    • Target
      RFQ#116236SO#929198.exe
    • Size 822KB
    • SHA256 e232dc56a916d659961271caf129b47c5fa561f71ecff17f6c96801cd7b50820
    • MD5 SHA1 SHA512
    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook Payload

    • Deletes itself

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks