General

  • Target
    97bfeff0f03f6d6cc84cccb087f2fef805c6d8c55693a19d43b8ae74702a32ef
  • Size 1.1MB
  • Sample201106-grfdtmr142
  • SHA256 97bfeff0f03f6d6cc84cccb087f2fef805c6d8c55693a19d43b8ae74702a32ef
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • formbook

C2
  • http://www.bottrader.digital/d8h/

Decoy
  • citizen10.com

  • shalynmusic.com

  • jerseycoastcollectibles.com

  • ilginozgul.academy

  • meralbilkay.com

  • sparkasse-suedpfalz.net

  • blackbeltbeef.farm

  • careermoatsbook.com

  • angiesaludable.com

  • 9y9y9.xyz

  • freyafallen.com

  • cbluebelt3dwdbuy.com

  • steeltownlabs.com

  • maskupforschool.com

  • unicornnotary.com

  • erometa.com

  • albumofindia.online

  • danhuman.com

  • denizlidekep.com

  • kenna.foundation

Targets

    • Target
      97bfeff0f03f6d6cc84cccb087f2fef805c6d8c55693a19d43b8ae74702a32ef
    • Size 1.1MB
    • SHA256 97bfeff0f03f6d6cc84cccb087f2fef805c6d8c55693a19d43b8ae74702a32ef
    • MD5 SHA1 SHA512
    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook Payload

    • Uses the VBS compiler for execution

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks