General

  • Target
    do202120102_010010101001010.pdf.exe
  • Size 883KB
  • Sample210221-pspywbcmmj
  • SHA256 878780dd4a45cd2ac3266e865c987933f7f6539fe93f6bc6b314188b2e5d2a45
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • formbook

C2
  • http://www.coincrush.net/fzd/

Decoy
  • vn-mua-hang-onlike.site

  • creationsbylisaq.com

  • clouduwo.com

  • archlvedata.com

  • casanoriamaderas.com

  • plouceur.com

  • thrivewarrioracademy.com

  • saraviafirma.com

  • letstalktech.tech

  • rhetfox.com

  • clmssouth.com

  • thecatstits.net

  • mepain.space

  • thepapaya.xyz

  • gaplek.net

  • llcom.net

  • estrategassocial.com

  • sliming.life

  • progressofindia.com

  • fakedoctorsrealfriendsmerch.com

Targets

    • Target
      do202120102_010010101001010.pdf.exe
    • Size 883KB
    • SHA256 878780dd4a45cd2ac3266e865c987933f7f6539fe93f6bc6b314188b2e5d2a45
    • MD5 SHA1 SHA512
    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook Payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks