General

  • Target
    ORDER LIST.exe
  • Size 579KB
  • Sample201109-lnjgpthv3x
  • SHA256 c18c5e02d67ca2dea08e13f3731c5dd0f5d8833bf2b606287c97e1d053564b85
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • formbook

C2
  • http://www.bottrader.digital/d8h/

Decoy
  • citizen10.com

  • shalynmusic.com

  • jerseycoastcollectibles.com

  • ilginozgul.academy

  • meralbilkay.com

  • sparkasse-suedpfalz.net

  • blackbeltbeef.farm

  • careermoatsbook.com

  • angiesaludable.com

  • 9y9y9.xyz

  • freyafallen.com

  • cbluebelt3dwdbuy.com

  • steeltownlabs.com

  • maskupforschool.com

  • unicornnotary.com

  • erometa.com

  • albumofindia.online

  • danhuman.com

  • denizlidekep.com

  • kenna.foundation

Targets

    • Target
      ORDER LIST.exe
    • Size 579KB
    • SHA256 c18c5e02d67ca2dea08e13f3731c5dd0f5d8833bf2b606287c97e1d053564b85
    • MD5 SHA1 SHA512
    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook Payload

    • Uses the VBS compiler for execution

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks