General

  • Target
    CONT NO DFSU125310 products list.exe
  • Size 1.0MB
  • Sample210226-pyghp91q7e
  • SHA256 9f38ade8e53d28eef33a81e0559b92b44fa878ae9b61fadd3bb245d33486e2c0
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • formbook

C2
  • http://www.discorddeno.land/suod/

Decoy
  • casirivimab.info

  • johnvogia.com

  • lzdafang.com

  • tarihmarketi.com

  • singalongpress.com

  • three60farms.com

  • websky.pro

  • jacketsmecca.com

  • magentos6.com

  • brooksideseniorapts.com

  • onewhistleandflags.com

  • naturopathe-valdoise-france.com

  • reflexmem.com

  • kurumsalpanel.com

  • bhuwarecruitment.com

  • exponentialhealth.online

  • posttensionrepairs.com

  • prbrokerllc.com

  • aashealthcarestaffing.com

  • pubgeventcenter.com

Targets

    • Target
      CONT NO DFSU125310 products list.exe
    • Size 1.0MB
    • SHA256 9f38ade8e53d28eef33a81e0559b92b44fa878ae9b61fadd3bb245d33486e2c0
    • MD5 SHA1 SHA512
    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook Payload

    • Deletes itself

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks