General

  • Target
    mses.exe
  • Size 455KB
  • Sample201105-nhmfca7572
  • SHA256 6847d25820be1a4d252df58d3652e103f33af5a43f12febeae71ac66385b0380
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • formbook

C2
  • http://www.lightmeets.com/c237/

Decoy
  • bulletprooflogisticscompany.com

  • yesonv4mpc.net

  • villasegovia.com

  • aowutai.com

  • alpraa.space

  • transformationnatural.life

  • xiaopoplar.xyz

  • rogvids.site

  • lincolndigital.agency

  • hein.ltd

  • homewelldecor.com

  • essenciaalentejana.com

  • sulehome.com

  • handsometed.com

  • sustainableroadtrips.com

  • jessicascottwriter.com

  • stefanieaoki.com

  • jvrad.com

  • salesperformance360.com

  • jayvanwinkle.com

Targets

    • Target
      mses.exe
    • Size 455KB
    • SHA256 6847d25820be1a4d252df58d3652e103f33af5a43f12febeae71ac66385b0380
    • MD5 SHA1 SHA512
    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook Payload

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks