General

  • Target

    Payment - Swift Copy.exe

  • Size

    878KB

  • Sample

    201126-83p6vypksx

  • MD5

    373529da43706b9b230586b501a000fd

  • SHA1

    d1a0ad8fe1c1adc9d27b5ceb3d7d27c9512c5495

  • SHA256

    49e40687ad1ffb7ba491d92cd38333d3e96c134ba7739dcdd3e8ee2ea1b19506

  • SHA512

    f5ba8fbb2409decc4982c5b9d0c7f6b479e8f184af33e99333b23fbfd493888477aa0442bf58290439bda2b2b26fa729aa6e6d0e2fa6ebe8cd23f0f916a4a085

Malware Config

Extracted

Family

formbook

C2

http://www.danneroll.com/mnc/

Decoy

yicaiboli.com

litercoconut.icu

virtuallyfriday.com

joshuahumphreyproperty.com

mercedes-dieselclaims.com

rock-leaf.com

sandglasshours.com

pooldeckpatiodriveway.com

forenvid.com

wasserfuhr-gmbh.com

rizosmil.com

alberletgyor.com

besafetexting.com

ladoctoracorazon.net

prettyassframes.com

meetyourwish.com

achefskiss.com

parulata.com

thang8-freefirevn2.xyz

statuniverse.com

Targets

    • Target

      Payment - Swift Copy.exe

    • Size

      878KB

    • MD5

      373529da43706b9b230586b501a000fd

    • SHA1

      d1a0ad8fe1c1adc9d27b5ceb3d7d27c9512c5495

    • SHA256

      49e40687ad1ffb7ba491d92cd38333d3e96c134ba7739dcdd3e8ee2ea1b19506

    • SHA512

      f5ba8fbb2409decc4982c5b9d0c7f6b479e8f184af33e99333b23fbfd493888477aa0442bf58290439bda2b2b26fa729aa6e6d0e2fa6ebe8cd23f0f916a4a085

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook Payload

    • Deletes itself

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks