General

  • Target
    469nGuFQyVJyw0O.exe
  • Size 531KB
  • Sample201027-2dgpnwar92
  • SHA256 8e816e44eb6ebdc6b99876142caba3fc1f8a0633edec29e8c1ae3f57e1ca55c9
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • formbook

C2
  • http://www.bfboke.com/cpi/

Decoy
  • tw2dl.com

  • cdmingjun.com

  • tamquin.net

  • shipu252.com

  • teamxnd02.com

  • finansi.website

  • datainnbooking.com

  • shannonballcoach.com

  • giaoruou.club

  • tierraycielo.com

  • quizfall.info

  • hallwayworker.guru

  • smartfundoptions.com

  • iishon11.com

  • zzg-wj7k9.net

  • mylinkbio.com

  • xn--kzw5tq0of14b.com

  • coursereel.club

  • koalainsulationinc.com

  • 5ljhyr.com

Targets

    • Target
      469nGuFQyVJyw0O.exe
    • Size 531KB
    • SHA256 8e816e44eb6ebdc6b99876142caba3fc1f8a0633edec29e8c1ae3f57e1ca55c9
    • MD5 SHA1 SHA512
    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook Payload

    • Deletes itself

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks