General

  • Target
    Product Sample.exe.exe
  • Size 548KB
  • Sample201019-qxzc4fdwra
  • SHA256 68ea8e450d6a5df8ae9d671ac8f4d1f60548992e0e7b0ed32c1587fe7d7d14f2
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • formbook

C2
  • http://www.kaylas505.com/ndf/

Decoy
  • kondigima.com

  • goldyears.com

  • eelnola.com

  • alphatradersclub.com

  • senanoble.com

  • bonefishbluff.com

  • niftycollectibles.com

  • glorifiedbeautyhair.com

  • greentea-goku.com

  • arabdebates.com

  • ffkk8.xyz

  • jvmarineelectrical.com

  • samirweb.com

  • plungeplay.com

  • carry-hai.com

  • anthelionlights.com

  • pleiadianmother.com

  • gilbertdodge.com

  • comgwy.info

  • makeupstephanieprada.com

Targets

    • Target
      Product Sample.exe.exe
    • Size 548KB
    • SHA256 68ea8e450d6a5df8ae9d671ac8f4d1f60548992e0e7b0ed32c1587fe7d7d14f2
    • MD5 SHA1 SHA512
    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook Payload

    • Deletes itself

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks