General

  • Target
    8a6753d0479e84e6c204166509a93c0d.exe
  • Size 782KB
  • Sample201208-vqdbty2kxs
  • SHA256 be7f98aff3b0e3bd6c740ee80ce002df7a7a8d979221b69c3916f5915cdfd37d
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • formbook

C2
  • http://www.poweruppowerwashing.com/21m/

Decoy
  • eoirfdklelkfdlfmd.com

  • veteransforgolden.com

  • psychtalent.com

  • crusder-coffee.com

  • sydneydetective.com

  • judahbbqjerk.com

  • core-sys.com

  • fukaikeji.com

  • xn--jpr220deud640b.com

  • joker91.com

  • artbyprslla.com

  • sms-email.xyz

  • coobook.credit

  • growerfertilizer.com

  • dollarbillnow1.com

  • alcanfor.net

  • tightsharkpoker.com

  • liveforlebanon.com

  • edupods.net

  • passoverindubai.com

Targets

    • Target
      8a6753d0479e84e6c204166509a93c0d.exe
    • Size 782KB
    • SHA256 be7f98aff3b0e3bd6c740ee80ce002df7a7a8d979221b69c3916f5915cdfd37d
    • MD5 SHA1 SHA512
    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook Payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks