General

  • Target
    3cf8157c0d82e2e0bba68515d5047ee3.exe
  • Size 812KB
  • Sample210306-2rpgwxjp82
  • SHA256 6c131f342e8226706ba1b39cc955852b022130c14ea12bd3b3cf340bbea25bf6
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • formbook

C2
  • http://www.peiyin.love/mjs/

Decoy
  • i-am-expressions.com

  • jvtnywveba.club

  • lifestorycards.com

  • vio-lence-official.com

  • themusicianchallenge.com

  • lebootenews.com

  • takcherry.com

  • offplannews.com

  • kdgdtools.com

  • 10best-hosting.com

  • glossyrag.com

  • mariettepottsphotography.com

  • lovelyeses.com

  • vualpe.com

  • moqshare.com

  • reikihealingcommunity.com

  • riverrockla.com

  • themaogroup.com

  • pachucosax.com

  • yogeshsuryavanshi.com

Targets

    • Target
      3cf8157c0d82e2e0bba68515d5047ee3.exe
    • Size 812KB
    • SHA256 6c131f342e8226706ba1b39cc955852b022130c14ea12bd3b3cf340bbea25bf6
    • MD5 SHA1 SHA512
    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook Payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks