General

  • Target
    DK Purchase Order 2021 - 00041.exe
  • Size 1004KB
  • Sample210322-skf4cjlrn6
  • SHA256 58626b2130d20a2bacbcefa97d06dc1e4d55b123a86a3f074bd2e8212ee60ae8
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • formbook

C2
  • http://www.otokoikon.com/vsk9/

Decoy
  • 545earth.com

  • womandigitalrights.net

  • tczxsjw.com

  • tuvantuyensinh24h.com

  • augiocxqo.icu

  • textingtexan.com

  • cheaperwhere.com

  • owe.pink

  • canzonianni90.com

  • explorehisword.com

  • alexaglobe.com

  • comharbookkeeping.com

  • insportseurolatam.com

  • rockplaylists.com

  • masqueareas.com

  • peixunzx.com

  • loudmouse-ent.com

  • medtopharma.com

  • jokersupadte.com

  • axsm0815.com

Targets

    • Target
      DK Purchase Order 2021 - 00041.exe
    • Size 1004KB
    • SHA256 58626b2130d20a2bacbcefa97d06dc1e4d55b123a86a3f074bd2e8212ee60ae8
    • MD5 SHA1 SHA512
    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook Payload

    • Deletes itself

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks