General

  • Target
    ORDER 20200717-019.exe
  • Size 612KB
  • Sample201106-9sl1bx6y8a
  • SHA256 a244a77f990bdec5f4f81d605990749206b6e5827e4bc140b9b4b2fbfdb0bb12
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • formbook

C2
  • http://www.stocksmusic.com/svh9/

Decoy
  • jejupassive.com

  • schoolrepetit.site

  • ganfraud.com

  • kuoretkauppa.com

  • bgdocs.online

  • climatechampionsfund.info

  • lamaletadeagustin.com

  • jessicaolear.com

  • oncologyacademe.com

  • aurum.academy

  • thaliasoap.com

  • tempeindo.online

  • alnajem-law.com

  • eracab.com

  • ozerk.site

  • 3drinkmin.com

  • synergygroup.fitness

  • foundyourlabel.info

  • bonniebagay.com

  • wcncusa.com

Targets

    • Target
      ORDER 20200717-019.exe
    • Size 612KB
    • SHA256 a244a77f990bdec5f4f81d605990749206b6e5827e4bc140b9b4b2fbfdb0bb12
    • MD5 SHA1 SHA512
    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook Payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks