General

  • Target
    02-016.exe
  • Size 732KB
  • Sample210216-lb2hyc4he6
  • SHA256 fdf3aa0df3a0d4a6d053c55b970ad22f71f5db88f2da4f94bc18f1926b731f1b
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • formbook

C2
  • http://www.unitedfootballcamps.com/bf3/

Decoy
  • ecatcom.com

  • what3emoji.com

  • primbathandbody.com

  • yt-itclub.com

  • newbieeer.com

  • getyoursofa.com

  • mexicanitems.info

  • catalogcardgames.net

  • leagueofwomengolfers.com

  • gvanmp.com

  • midnightsunhi.com

  • cnluma.com

  • sunsetcherrydesigns.com

  • cosmoproturkey.com

  • inifinityapps.net

  • making50masks.com

  • battalionice.com

  • uk-calculation.net

  • frosteatlove.com

  • bs-mag.com

Targets

    • Target
      02-016.exe
    • Size 732KB
    • SHA256 fdf3aa0df3a0d4a6d053c55b970ad22f71f5db88f2da4f94bc18f1926b731f1b
    • MD5 SHA1 SHA512
    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook Payload

    • Deletes itself

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks