General

  • Target
    payment advice00000789_pdf.exe
  • Size 866KB
  • Sample210112-hs5jccmade
  • SHA256 c3d490568e73f61c86d2d4c01e170bdcf3c0d3eb5e309ff3d3fb808a4a867a54
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • formbook

C2
  • http://www.aftabzahur.com/wgn/

Decoy
  • kokokara-life-blog.com

  • faswear.com

  • futureleadershiptoday.com

  • date4done.xyz

  • thecouponinn.com

  • bbeycarpetsf.com

  • propolisnasalspray.com

  • jinjudiamond.com

  • goodevectors.com

  • nehyam.com

  • evalinkapuppets.com

  • what-if-statistics.com

  • rateofrisk.com

  • impacttestonlinne.com

  • servis-kaydet.info

  • coloniacafe.com

  • marcemarketing.com

  • aarigging.com

  • goddesswitchery.com

  • jasqblo.icu

Targets

    • Target
      payment advice00000789_pdf.exe
    • Size 866KB
    • SHA256 c3d490568e73f61c86d2d4c01e170bdcf3c0d3eb5e309ff3d3fb808a4a867a54
    • MD5 SHA1 SHA512
    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook Payload

    • Deletes itself

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks