General

  • Target
    HMT-200810-02.exe
  • Size 713KB
  • Sample201105-g2yd1mgh7a
  • SHA256 e3114262b2bf20de2c2b95534ba7c5ce497f894a3ecd99005f698a853c7f3b3e
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • formbook

C2
  • http://www.unpreneurmania.com/ve9i/

Decoy
  • crystallynnhealthcoach.com

  • leggingclubs.com

  • artpeixun.com

  • sanguineeses.com

  • 865kcd.com

  • pacificwayexpress.com

  • unioncountyneighbors.com

  • taohuayuji.com

  • kerempe.com

  • worldclassgem.com

  • berakahholdings.com

  • rechardpeelphotography.com

  • rasgobenadache.com

  • kyg.global

  • innovation-innovation.com

  • tipsforstudying.com

  • albert.fitness

  • familycontractingwi.com

  • covid19overwatch.com

  • arcfleur.com

Targets

    • Target
      HMT-200810-02.exe
    • Size 713KB
    • SHA256 e3114262b2bf20de2c2b95534ba7c5ce497f894a3ecd99005f698a853c7f3b3e
    • MD5 SHA1 SHA512
    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook Payload

    • Deletes itself

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks