General

  • Target
    supporting documents.exe
  • Size 927KB
  • Sample210312-fsq73s1trs
  • SHA256 f39b9e8c4a9aa6d8cd9f069e8a8ee81a3f666e07071f2b4673aa42633026736c
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • formbook

C2
  • http://www.the-techs.info/chue/

Decoy
  • wowmovies.today

  • magentos6.com

  • bi-nav.com

  • atlantahawks.sucks

  • wluabjy.icu

  • kevableinsights.com

  • lavidaenaustralia.com

  • stonermadeapparel.net

  • sondein.com

  • cirquedusoleilartist.com

  • kanjitem.com

  • tomofalltrades.site

  • mecanico.guru

  • tech2020s.com

  • amesoneco.com

  • theawfulliar.com

  • californiaadugurus.com

  • rentalservicesolutions.com

  • fsxbhd.club

  • casino-seo.com

Targets

    • Target
      supporting documents.exe
    • Size 927KB
    • SHA256 f39b9e8c4a9aa6d8cd9f069e8a8ee81a3f666e07071f2b4673aa42633026736c
    • MD5 SHA1 SHA512
    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook Payload

    • Deletes itself

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks