General

  • Target
    PO_210223.exe
  • Size 783KB
  • Sample210223-bpphp3tkt2
  • SHA256 38acc90cd6d33b61b99cca8cf06781e1bd2ab8ffebc3a33e036eca36037d413b
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • formbook

C2
  • http://www.000666dy.com/ntg/

Decoy
  • successwithyolandafgreen.com

  • theordinaryph.com

  • atamyo-therapeutics.com

  • pophazard.com

  • anthonyfultz.com

  • pasanglham.com

  • kanekhushi.com

  • littlefishyswim.com

  • kaieteurny.com

  • fanavartima.com

  • digexpo.com

  • se-rto.com

  • chaos.finance

  • bakldx.com

  • after-school.pro

  • faithfromphilly.com

  • estudiomuradian.com

  • albertocerasini.com

  • andronna.com

  • wingspotusa.com

Targets

    • Target
      PO_210223.exe
    • Size 783KB
    • SHA256 38acc90cd6d33b61b99cca8cf06781e1bd2ab8ffebc3a33e036eca36037d413b
    • MD5 SHA1 SHA512
    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook Payload

    • Deletes itself

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks