General

  • Target
    Order.exe
  • Size 197KB
  • Sample210107-rem2pwysqj
  • SHA256 ee8ac19b40be65306741e69e41cc3768e469fedd9a55b8a1ff3a24723f6fd6da
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • formbook

C2
  • http://www.nationshiphop.com/hko6/

Decoy
  • apartmentsineverettwa.com

  • forritcu.net

  • hotroodes.com

  • skinnerttc.com

  • royaltrustmyanmar.com

  • adreslog.com

  • kaysbridalboutiques.com

  • multitask-improvements.com

  • geniiforum.com

  • smarthomehatinh.asia

  • banglikeaboss.com

  • javlover.club

  • affiliateclubindia.com

  • mycapecoralhomevalue.com

  • comparamuebles.online

  • newrochellenissan.com

  • nairobi-paris.com

  • fwk.xyz

  • downdepot.com

  • nextgenmemorabilia.com

Targets

    • Target
      Order.exe
    • Size 197KB
    • SHA256 ee8ac19b40be65306741e69e41cc3768e469fedd9a55b8a1ff3a24723f6fd6da
    • MD5 SHA1 SHA512
    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook Payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks