General

  • Target
    new requests.exe
  • Size 738KB
  • Sample201105-herycs2mn6
  • SHA256 106bfa0280569ce313c19beb1c68515fb148212a033fdd96ef075d38256f5fb9
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • formbook

C2
  • http://www.thehappyhourtimes.com/z0po/

Decoy
  • trouverunartisanserieux.com

  • dawn-niece.xyz

  • smalltree2021.com

  • asiansforliberty.com

  • suyeaimwnd.com

  • 67630pp.com

  • drinkdeliveryservices.com

  • icollect-auctions.com

  • transformintecture.com

  • systemaircn.com

  • bluemonkeyhealingenergy.com

  • joebartonproducts.com

  • sacredclouddesigns.com

  • discovertravelco.com

  • haxb33.xyz

  • soldadorprofissional.com

  • disruptergen.com

  • senvias12.com

  • culinaryrambler.net

  • hnhlsm.com

Targets

    • Target
      new requests.exe
    • Size 738KB
    • SHA256 106bfa0280569ce313c19beb1c68515fb148212a033fdd96ef075d38256f5fb9
    • MD5 SHA1 SHA512
    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook Payload

    • Deletes itself

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks