General

  • Target
    d642f78e75dad522b4e70a3227d61ec7.exe
  • Size 577KB
  • Sample210320-b2pd3rg6xx
  • SHA256 c062a826e467a5e607d373ab12fcae11d0eec7ff4fdfe04d4e5de4250d7f8f88
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • formbook

C2
  • http://www.leelegantflower.com/gts/

Decoy
  • insurance-taxes.com

  • espressoandhoney.com

  • applepanda.com

  • pabloleoncontador.com

  • medpia.net

  • veriezy.com

  • tzcysi.com

  • manconnectr.services

  • partyoftres.com

  • bradfordbarbell.com

  • xunte8.com

  • unitedstatecryptobank.com

  • idracasting.com

  • stoufferfurnitureandmilling.com

  • collaboratewithablackwoman.info

  • thestandardstripdoors.com

  • your-masterclass.online

  • mintmobikeplus.com

  • arboristunit.com

  • tn-adrc.com

Targets

    • Target
      d642f78e75dad522b4e70a3227d61ec7.exe
    • Size 577KB
    • SHA256 c062a826e467a5e607d373ab12fcae11d0eec7ff4fdfe04d4e5de4250d7f8f88
    • MD5 SHA1 SHA512
    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook Payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks