General

  • Target
    invoic.exe
  • Size 358KB
  • Sample201218-1e77twjybj
  • SHA256 e59d9d9ca9e0c7dddea9a94f0dab0ae137b6a762999bade26db35b1ca35e1f72
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • formbook

C2
  • http://www.helpmeiminmytwenties.com/oncs/

Decoy
  • premiokapuscinski.com

  • metrteor.com

  • alignablesolutions.com

  • wajevctytwe.com

  • prospervine.net

  • camsplaces.com

  • kart-im.com

  • neothecode.com

  • fishingpeer.com

  • soulcave.xyz

  • bobqp6.com

  • phonpiegift.club

  • veteranmadecontent.com

  • domini-o-pessoal.com

  • featuredtv.com

  • thebugbros.com

  • gamedesignpostmortem.com

  • equineluv.com

  • zhongden.com

  • pbwts.com

Targets

    • Target
      invoic.exe
    • Size 358KB
    • SHA256 e59d9d9ca9e0c7dddea9a94f0dab0ae137b6a762999bade26db35b1ca35e1f72
    • MD5 SHA1 SHA512
    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook Payload

    • Deletes itself

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks