General

  • Target
    13012021.exe
  • Size 1.0MB
  • Sample210113-hyn52828dn
  • SHA256 ae73e8799690e6e7efe2222fe8a471af2c7f7f0f82dff259434626eac35a2721
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • formbook

C2
  • http://www.timoniks.com/rbg/

Decoy
  • fingermode.com

  • parkplace.finance

  • hollandgreen2020.com

  • starbets.site

  • vehiculesfrigorifiques.com

  • sydiifinancial.com

  • rpivuenation.com

  • freesubdirectory.com

  • independencepartynyc.com

  • dogruparti.info

  • independencecountyclub.com

  • midnightlashesbykim.com

  • digitalsept.com

  • whatilikeabouttoday.com

  • marktplaatsaccount.info

  • 13400667334.com

  • xinwei-ge.com

  • login-appleid.info

  • momashands.com

  • kennyxpress.com

Targets

    • Target
      13012021.exe
    • Size 1.0MB
    • SHA256 ae73e8799690e6e7efe2222fe8a471af2c7f7f0f82dff259434626eac35a2721
    • MD5 SHA1 SHA512
    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook Payload

    • Deletes itself

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks