General

  • Target
    Purchase Order pdf.exe
  • Size 764KB
  • Sample210221-41gmnkjc8n
  • SHA256 1d0aa1485b2e4d3e411e2d2e9ddfc3763120082cc039972770d5aa882fd4cb87
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • formbook

C2
  • http://www.brasilseo.com/bft/

Decoy
  • edenicities.com

  • buntingfordhomeservices.com

  • nuanceproducoes.com

  • divasinspire.com

  • capiturn.com

  • zbjsn.com

  • thegioicaytrongnha.com

  • featherventure.com

  • onbrandtrading.com

  • sanguoban.com

  • doorman.pro

  • ourhomie.net

  • iwassickonholiday.com

  • mrcskin.com

  • reallycoolmask.com

  • tkrbeautyinstitut.com

  • keytomiami.com

  • sesliduybeni.com

  • asherwebber.com

  • starkweatherwindows.net

Targets

    • Target
      Purchase Order pdf.exe
    • Size 764KB
    • SHA256 1d0aa1485b2e4d3e411e2d2e9ddfc3763120082cc039972770d5aa882fd4cb87
    • MD5 SHA1 SHA512
    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook Payload

    • Deletes itself

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks