General

  • Target
    Pending PURCHASE ORDER - 47001516.pdf.exe
  • Size 284KB
  • Sample210108-p1tljdqv8a
  • SHA256 c1a564800071499d39ba2f7e92c403c9ec87ca7837bafd76d00dbe37589c9eb3
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • formbook

C2
  • http://www.evana-rohanihijab.com/iic6/

Decoy
  • capableandresilient.com

  • listaprzygod.com

  • cashhomeprogram.com

  • aboutwheelchair.com

  • clk4milli.club

  • asakitreks.com

  • liquiddreamworld.com

  • uqur88.com

  • bestifystore.com

  • arancionehq.xyz

  • mmoimperium.com

  • houxinjian.com

  • satmonitoring.com

  • tidalhaven.com

  • blcdevelopers.com

  • piratesofthefun.com

  • kadopulsa.com

  • xn--o39au6k0nm4rghsaq0c.net

  • wxxxtw.com

  • kyrtjf.com

Targets

    • Target
      Pending PURCHASE ORDER - 47001516.pdf.exe
    • Size 284KB
    • SHA256 c1a564800071499d39ba2f7e92c403c9ec87ca7837bafd76d00dbe37589c9eb3
    • MD5 SHA1 SHA512
    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook Payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks