General

  • Target
    Artha Karya Utama (Aku Food) - Quotation.exe
  • Size 1.3MB
  • Sample201027-4kglrbdpc2
  • SHA256 0375352dd935ee474c225b1e7c35707a10f7100b0167bbabd5a497dbb34777cf
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • formbook

C2
  • http://www.goldenlinkpowerdeals.com/esp5/

Decoy
  • hydrationgo.com

  • 16939meadowcrest.info

  • coopname.com

  • rentaroompattaya.com

  • elena-zabrodina.com

  • veronicaspeaks.net

  • bleeask.com

  • moneytransfergas.com

  • marylandmtb.com

  • pencil-cone.com

  • mypilzer.com

  • seniorngr.com

  • myvcardhub.com

  • uwn5depranium.xyz

  • muddycreekservices.com

  • bodrum-ua.com

  • sfadfdfsdf.club

  • empreendernaweb.net

  • shopwearesdg.com

  • gestiondeproyectoscp6.com

Targets

    • Target
      Artha Karya Utama (Aku Food) - Quotation.exe
    • Size 1.3MB
    • SHA256 0375352dd935ee474c225b1e7c35707a10f7100b0167bbabd5a497dbb34777cf
    • MD5 SHA1 SHA512
    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook Payload

    • Deletes itself

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks