General

  • Target
    m1FW0cryNz0hRX3.exe
  • Size 501KB
  • Sample201020-45ccepdsra
  • SHA256 0bfa5712201676e9439c4624fd99b8ec2bba95ccd53fb67f0a289b0a8347fc7c
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • formbook

C2
  • http://www.bfboke.com/cpi/

Decoy
  • tw2dl.com

  • cdmingjun.com

  • tamquin.net

  • shipu252.com

  • teamxnd02.com

  • finansi.website

  • datainnbooking.com

  • shannonballcoach.com

  • giaoruou.club

  • tierraycielo.com

  • quizfall.info

  • hallwayworker.guru

  • smartfundoptions.com

  • iishon11.com

  • zzg-wj7k9.net

  • mylinkbio.com

  • xn--kzw5tq0of14b.com

  • coursereel.club

  • koalainsulationinc.com

  • 5ljhyr.com

Targets

    • Target
      m1FW0cryNz0hRX3.exe
    • Size 501KB
    • SHA256 0bfa5712201676e9439c4624fd99b8ec2bba95ccd53fb67f0a289b0a8347fc7c
    • MD5 SHA1 SHA512
    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook Payload

    • Deletes itself

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks