General

  • Target
    request_quotes.exe
  • Size 733KB
  • Sample201022-jneas6d52a
  • SHA256 a50fdfd2a59cafe23cd41227b465d44b6d00e2b14f707798d60d2637ff78ef25
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • formbook

C2
  • http://www.thehappyhourtimes.com/z0po/

Decoy
  • trouverunartisanserieux.com

  • dawn-niece.xyz

  • smalltree2021.com

  • asiansforliberty.com

  • suyeaimwnd.com

  • 67630pp.com

  • drinkdeliveryservices.com

  • icollect-auctions.com

  • transformintecture.com

  • systemaircn.com

  • bluemonkeyhealingenergy.com

  • joebartonproducts.com

  • sacredclouddesigns.com

  • discovertravelco.com

  • haxb33.xyz

  • soldadorprofissional.com

  • disruptergen.com

  • senvias12.com

  • culinaryrambler.net

  • hnhlsm.com

Targets

    • Target
      request_quotes.exe
    • Size 733KB
    • SHA256 a50fdfd2a59cafe23cd41227b465d44b6d00e2b14f707798d60d2637ff78ef25
    • MD5 SHA1 SHA512
    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook Payload

    • Deletes itself

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks