General

  • Target
    d8bb039f1f1d49caee5018e499583342.exe
  • Size 645KB
  • Sample201115-xflna9kz2e
  • SHA256 6b4b7e04b908d027fd811be6d25ceaa5e45eee1628467f686b35ed73bf411a76
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • formbook

C2
  • http://www.0rdergreatcourses.com/tlu/

Decoy
  • tyvyt.com

  • duchik13.site

  • jesussavethelost.com

  • park-serv.com

  • raheellakhani.info

  • cultivosencasa.com

  • dailytech365.com

  • bluemountainbrewingcompany.com

  • psychedelic60sonlive365.com

  • moddi.online

  • planetcourier.asia

  • thorjohnson4sc.com

  • decoratorsyork.com

  • thekingskave.com

  • mycologyshrooms.com

  • bersalupapalu09.com

  • droidmaestro.com

  • resolveit.solutions

  • allaboutmakeonlinemoney.com

  • customersverlfycom.com

Targets

    • Target
      d8bb039f1f1d49caee5018e499583342.exe
    • Size 645KB
    • SHA256 6b4b7e04b908d027fd811be6d25ceaa5e45eee1628467f686b35ed73bf411a76
    • MD5 SHA1 SHA512
    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook Payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks