General

  • Target
    AWBInvoice INA101970.exe
  • Size 830KB
  • Sample201229-9ae99nnee2
  • SHA256 7c3b63765f896c6e5faf093f002fa0f854994a1ea028a9abf53e7fdc8a3f18a4
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • formbook

C2
  • http://www.ameeraglow.com/6bu2/

Decoy
  • shuttergame.com

  • beyondregions.com

  • cuttingedgetinting.com

  • riveraspanishfoods.com

  • jfksn.com

  • rtplay2020.com

  • idahofallsobituaries.com

  • qf432.com

  • magandaconfections.com

  • suremlak.com

  • tuproductividadpersonal.com

  • ziswmyxaw.icu

  • howtolovemybody.com

  • signpartnerpro.com

  • conservative-forward.com

  • bhscsh.com

  • todowine.com

  • garrettthermaldetector.com

  • bunbook.com

  • ehealthla.com

Targets

    • Target
      AWBInvoice INA101970.exe
    • Size 830KB
    • SHA256 7c3b63765f896c6e5faf093f002fa0f854994a1ea028a9abf53e7fdc8a3f18a4
    • MD5 SHA1 SHA512
    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook Payload

    • Deletes itself

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks