General

  • Target
    po071.exe
  • Size 1.0MB
  • Sample210120-19lv9k6rt6
  • SHA256 ed9c5c6d05892ce64f553810dcb3e3f2e8f0f58d46888bbfeeb744e89dd1cf8e
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • formbook

C2
  • http://www.unitedfootballcamps.com/bf3/

Decoy
  • ecatcom.com

  • what3emoji.com

  • primbathandbody.com

  • yt-itclub.com

  • newbieeer.com

  • getyoursofa.com

  • mexicanitems.info

  • catalogcardgames.net

  • leagueofwomengolfers.com

  • gvanmp.com

  • midnightsunhi.com

  • cnluma.com

  • sunsetcherrydesigns.com

  • cosmoproturkey.com

  • inifinityapps.net

  • making50masks.com

  • battalionice.com

  • uk-calculation.net

  • frosteatlove.com

  • bs-mag.com

Targets

    • Target
      po071.exe
    • Size 1.0MB
    • SHA256 ed9c5c6d05892ce64f553810dcb3e3f2e8f0f58d46888bbfeeb744e89dd1cf8e
    • MD5 SHA1 SHA512
    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook Payload

    • Deletes itself

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks