General

  • Target
    TT copy.exe
  • Size 869KB
  • Sample201023-zh2v8asrm2
  • SHA256 8c288fd70a35727c16e668d49e1e28964d36a67804e09be663bca9a9ceaeacb4
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • formbook

C2
  • http://www.richardgraycabinetmaker.com/cmd/

Decoy
  • marksmanrealestate.com

  • weeiter.com

  • dimody.com

  • tufftech.pro

  • romber.info

  • 2theothercurb.com

  • maskibeauty.com

  • kreativedough.com

  • adanacatering.com

  • wordzninja.com

  • testxyy.xyz

  • lifeafterbobby.com

  • sunsageherbs.com

  • dentoncountyattorneys.media

  • 18176732933.com

  • fjhgllnrz.icu

  • cryptobankcustody.com

  • theinternetproducer.com

  • motinik.com

  • getcatickets.com

Targets

    • Target
      TT copy.exe
    • Size 869KB
    • SHA256 8c288fd70a35727c16e668d49e1e28964d36a67804e09be663bca9a9ceaeacb4
    • MD5 SHA1 SHA512
    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook Payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks