General

  • Target
    Additional Agreement 2020-KYC.exe
  • Size 558KB
  • Sample201106-trs8wmxdln
  • SHA256 dc647305de0ae67eff2e86276355bc83aa761b03693459df14d10ae6cd4a3102
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • formbook

C2
  • http://www.csgo-c4ses.com/bw82/

Decoy
  • orchid-iris.com

  • owner.codes

  • crispcleanbodyrituals.com

  • nocreditcarswestpalm.com

  • sweetsasu.com

  • downlooader.com

  • candleish.com

  • 43414newportdr.com

  • 78kanshu.net

  • tncnn.com

  • bcheaptvwd.com

  • trephone.art

  • aloharecords.com

  • latinaexpres.com

  • comminterbusiness.com

  • evokingcalm.com

  • mckarthylabscoe.com

  • make-trends.com

  • modernhomeskitchen.com

  • mousybusiness.com

Targets

    • Target
      Additional Agreement 2020-KYC.exe
    • Size 558KB
    • SHA256 dc647305de0ae67eff2e86276355bc83aa761b03693459df14d10ae6cd4a3102
    • MD5 SHA1 SHA512
    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook Payload

    • Deletes itself

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks