General

  • Target
    Outstanding payment Overdue for Invoice INV-2644.exe
  • Size 801KB
  • Sample201112-4f9p8wee6n
  • SHA256 d5693be3b4e0d78485c00d409aedbe5cf18fd22c413fac48b44a4eaa0bbda668
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • formbook

C2
  • http://www.pamforprogress.com/bg8v/

Decoy
  • patrickzajda.com

  • 40ye.com

  • foxyivys.com

  • higherstatusfreebook.com

  • pharmxpert.net

  • buyinglover.com

  • eresuli.com

  • officerrustensheskey.com

  • ghoster.agency

  • susanchanportfolio.com

  • etreunheros.com

  • yavcxas.com

  • jasonrbradwell.com

  • tods.info

  • hawksltd.com

  • rankpicker.net

  • rachelraydiet.com

  • foolishdrivers.com

  • amtpsychology.com

  • hffc365.com

Targets

    • Target
      Outstanding payment Overdue for Invoice INV-2644.exe
    • Size 801KB
    • SHA256 d5693be3b4e0d78485c00d409aedbe5cf18fd22c413fac48b44a4eaa0bbda668
    • MD5 SHA1 SHA512
    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook Payload

    • Deletes itself

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks