General

  • Target
    Purchase Order 40,7045$.exe
  • Size 361KB
  • Sample201120-bxvpamwsyn
  • SHA256 fd94ea05d07271de517e92af291ec6a8cff49cc83bb59f112efb6d5fec56809c
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • formbook

C2
  • http://www.sweetbasilmarketing.com/igqu/

Decoy
  • coveloungewineandwhiskey.com

  • chemtradent.com

  • educare.cloud

  • shopnicknaks.com

  • realitytvstockwatch.com

  • handsfreedocs.com

  • trafegopago.com

  • ariasu-nakanokaikei.com

  • allmm.info

  • elleatx.com

  • erpsystem.site

  • whatisastaxanthin.com

  • hemparcade.com

  • ownumo.com

  • pasumaisangam.com

  • theoutdoorbed.com

  • plantpowered.energy

  • elevenelevenapparelcompany.com

  • vrspace.ltd

  • justsoldbykristen.com

Targets

    • Target
      Purchase Order 40,7045$.exe
    • Size 361KB
    • SHA256 fd94ea05d07271de517e92af291ec6a8cff49cc83bb59f112efb6d5fec56809c
    • MD5 SHA1 SHA512
    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook Payload

    • Deletes itself

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks