General

  • Target
    AWBInvoice INA10197.exe
  • Size 927KB
  • Sample201228-ph555bhfp2
  • SHA256 cd3afb904bdbe5aa145aca40398017b76ef22f9fa85556c728f38744d57a3352
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • formbook

C2
  • http://www.ameeraglow.com/6bu2/

Decoy
  • shuttergame.com

  • beyondregions.com

  • cuttingedgetinting.com

  • riveraspanishfoods.com

  • jfksn.com

  • rtplay2020.com

  • idahofallsobituaries.com

  • qf432.com

  • magandaconfections.com

  • suremlak.com

  • tuproductividadpersonal.com

  • ziswmyxaw.icu

  • howtolovemybody.com

  • signpartnerpro.com

  • conservative-forward.com

  • bhscsh.com

  • todowine.com

  • garrettthermaldetector.com

  • bunbook.com

  • ehealthla.com

Targets

    • Target
      AWBInvoice INA10197.exe
    • Size 927KB
    • SHA256 cd3afb904bdbe5aa145aca40398017b76ef22f9fa85556c728f38744d57a3352
    • MD5 SHA1 SHA512
    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook Payload

    • Deletes itself

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks