General

  • Target
    484565bd236a0a3ff8e0ec762116d707.exe
  • Size 653KB
  • Sample210202-j5y4tmshvx
  • SHA256 95bd2c8256fc15082b1e8e0431439c226847bcb284871bdac55584abcab3af24
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • formbook

C2
  • http://www.theatomicshots.com/xle/

Decoy
  • tknbr.com

  • loyaloneconstruction.com

  • what-where.com

  • matebacapital.com

  • marriedandmore.com

  • qiemfsolutions.com

  • graececonsulting.com

  • www7456.com

  • littlefreecherokeelibrary.com

  • tailgatepawkinglot.com

  • musheet.com

  • tesfamariamtb.com

  • 1728025.com

  • xceltechuae.com

  • harperandchloe.com

  • thepamperedbarber.com

  • 5050alberta.com

  • supplychainstrainer.com

  • lacorte.group

  • ringingbear.com

Targets

    • Target
      484565bd236a0a3ff8e0ec762116d707.exe
    • Size 653KB
    • SHA256 95bd2c8256fc15082b1e8e0431439c226847bcb284871bdac55584abcab3af24
    • MD5 SHA1 SHA512
    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook Payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks