General

  • Target
    List items.exe
  • Size 929KB
  • Sample201209-1812apmm4a
  • SHA256 42ea844a6aeb6c01de060355e8333242f71553498514ca1bf7d4af32bb90803e
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • formbook

C2
  • http://www.lalaandthelight.com/hts/

Decoy
  • nymphomaniartist.com

  • thinkntyme.com

  • standardpharm.net

  • untangledesign.com

  • adrisable.com

  • theforgottencolony.com

  • renderpharma.com

  • jp231c.com

  • psilocybinenergy.com

  • oirtfqe.icu

  • viontelhotel.com

  • hotbloodedradio.com

  • motorstoretr.com

  • lapstan.com

  • takeexperts.com

  • elyzabeth.site

  • nicoloshoots.com

  • russpotts.com

  • forenvid.com

  • healinghappens.life

Targets

    • Target
      List items.exe
    • Size 929KB
    • SHA256 42ea844a6aeb6c01de060355e8333242f71553498514ca1bf7d4af32bb90803e
    • MD5 SHA1 SHA512
    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook Payload

    • Deletes itself

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks