General

  • Target
    350129441.exe
  • Size 1.4MB
  • Sample201222-t11vaft8jj
  • SHA256 34cb445ac6f9c3dc60d465baa8ffbbca5abaf84fce4ff7075628e6cd1d41c559
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • formbook

C2
  • http://www.ameeraglow.com/6bu2/

Decoy
  • shuttergame.com

  • beyondregions.com

  • cuttingedgetinting.com

  • riveraspanishfoods.com

  • jfksn.com

  • rtplay2020.com

  • idahofallsobituaries.com

  • qf432.com

  • magandaconfections.com

  • suremlak.com

  • tuproductividadpersonal.com

  • ziswmyxaw.icu

  • howtolovemybody.com

  • signpartnerpro.com

  • conservative-forward.com

  • bhscsh.com

  • todowine.com

  • garrettthermaldetector.com

  • bunbook.com

  • ehealthla.com

Targets

    • Target
      350129441.exe
    • Size 1.4MB
    • SHA256 34cb445ac6f9c3dc60d465baa8ffbbca5abaf84fce4ff7075628e6cd1d41c559
    • MD5 SHA1 SHA512
    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook Payload

    • Deletes itself

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks