General

  • Target
    d97a26894ec19dc562eec833ccb5607f.exe
  • Size 1.0MB
  • Sample210113-pez6ktb96j
  • SHA256 2fdfbfc735f43a4e2dce0c849b41ab83dd17228f6df983f7a95d6e427cdc77b0
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • formbook

C2
  • http://www.theatomicshots.com/xle/

Decoy
  • tknbr.com

  • loyaloneconstruction.com

  • what-where.com

  • matebacapital.com

  • marriedandmore.com

  • qiemfsolutions.com

  • graececonsulting.com

  • www7456.com

  • littlefreecherokeelibrary.com

  • tailgatepawkinglot.com

  • musheet.com

  • tesfamariamtb.com

  • 1728025.com

  • xceltechuae.com

  • harperandchloe.com

  • thepamperedbarber.com

  • 5050alberta.com

  • supplychainstrainer.com

  • lacorte.group

  • ringingbear.com

Targets

    • Target
      d97a26894ec19dc562eec833ccb5607f.exe
    • Size 1.0MB
    • SHA256 2fdfbfc735f43a4e2dce0c849b41ab83dd17228f6df983f7a95d6e427cdc77b0
    • MD5 SHA1 SHA512
    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook Payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks