General

  • Target
    b55b31cbefb2c6334eab9e955a208803.exe
  • Size 1.4MB
  • Sample210119-2w3cemr8nj
  • SHA256 410e324656b57d2eb5e1c0eabbdbda34d787f346ab817f1afbc388ea615c2585
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • formbook

C2
  • http://www.theatomicshots.com/xle/

Decoy
  • tknbr.com

  • loyaloneconstruction.com

  • what-where.com

  • matebacapital.com

  • marriedandmore.com

  • qiemfsolutions.com

  • graececonsulting.com

  • www7456.com

  • littlefreecherokeelibrary.com

  • tailgatepawkinglot.com

  • musheet.com

  • tesfamariamtb.com

  • 1728025.com

  • xceltechuae.com

  • harperandchloe.com

  • thepamperedbarber.com

  • 5050alberta.com

  • supplychainstrainer.com

  • lacorte.group

  • ringingbear.com

Targets

    • Target
      b55b31cbefb2c6334eab9e955a208803.exe
    • Size 1.4MB
    • SHA256 410e324656b57d2eb5e1c0eabbdbda34d787f346ab817f1afbc388ea615c2585
    • MD5 SHA1 SHA512
    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook Payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks