General

  • Target
    DHL DOCS..exe
  • Size 269KB
  • Sample201214-2lqljyb2wa
  • SHA256 cfa7189e67e325a2893d1b50cb4e6e477e30a012fb462bdf3d19b7e9e4ab8778
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • formbook

C2
  • http://www.newenglandredsox.com/lsa/

Decoy
  • funeralplansguide.com

  • weilandconstruction.com

  • newbiecasinos.com

  • xyzcomis.com

  • tequilasportfishingteam.com

  • lifesiizebeauty.com

  • consultoriostimbe.com

  • thedoughmad.com

  • lametserlx.com

  • tuchiasobi.com

  • polimarktrade.com

  • indicatormarket.com

  • bizbajar.site

  • toptimesharetalents.com

  • morrobaywindowcleaning.com

  • rare-snare.com

  • dnascreener.com

  • askwhat.space

  • toutsurlebio-nature.com

  • insidetauck.com

Targets

    • Target
      DHL DOCS..exe
    • Size 269KB
    • SHA256 cfa7189e67e325a2893d1b50cb4e6e477e30a012fb462bdf3d19b7e9e4ab8778
    • MD5 SHA1 SHA512
    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook Payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks