General

  • Target
    1b26c10e2aae78b074183e28b022301d.exe
  • Size 557KB
  • Sample210317-ldg9hhr3de
  • SHA256 056548a367412a9b7fcb2d136d1c425ecfc2b0627de5d6842a5b79cee17d67dd
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • formbook

C2
  • http://www.leelegantflower.com/gts/

Decoy
  • insurance-taxes.com

  • espressoandhoney.com

  • applepanda.com

  • pabloleoncontador.com

  • medpia.net

  • veriezy.com

  • tzcysi.com

  • manconnectr.services

  • partyoftres.com

  • bradfordbarbell.com

  • xunte8.com

  • unitedstatecryptobank.com

  • idracasting.com

  • stoufferfurnitureandmilling.com

  • collaboratewithablackwoman.info

  • thestandardstripdoors.com

  • your-masterclass.online

  • mintmobikeplus.com

  • arboristunit.com

  • tn-adrc.com

Targets

    • Target
      1b26c10e2aae78b074183e28b022301d.exe
    • Size 557KB
    • SHA256 056548a367412a9b7fcb2d136d1c425ecfc2b0627de5d6842a5b79cee17d67dd
    • MD5 SHA1 SHA512
    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook Payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks