General

  • Target
    Purchase Order 40,7045.exe
  • Size 339KB
  • Sample201121-blaeav9v7x
  • SHA256 7d4d5ddf016f84445c94bf5ee4d715be092f8711b70ebd17f48f2956fba0487d
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • formbook

C2
  • http://www.sweetbasilmarketing.com/igqu/

Decoy
  • coveloungewineandwhiskey.com

  • chemtradent.com

  • educare.cloud

  • shopnicknaks.com

  • realitytvstockwatch.com

  • handsfreedocs.com

  • trafegopago.com

  • ariasu-nakanokaikei.com

  • allmm.info

  • elleatx.com

  • erpsystem.site

  • whatisastaxanthin.com

  • hemparcade.com

  • ownumo.com

  • pasumaisangam.com

  • theoutdoorbed.com

  • plantpowered.energy

  • elevenelevenapparelcompany.com

  • vrspace.ltd

  • justsoldbykristen.com

Targets

    • Target
      Purchase Order 40,7045.exe
    • Size 339KB
    • SHA256 7d4d5ddf016f84445c94bf5ee4d715be092f8711b70ebd17f48f2956fba0487d
    • MD5 SHA1 SHA512
    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook Payload

    • Deletes itself

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks