General

  • Target
    Purchase Order 2021 - 00041.exe
  • Size 911KB
  • Sample210324-7rhdga1e5e
  • SHA256 8afb80762bc90479ba2d8f4237e755f78ea789601781615088dfa52f3e87d72a
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • formbook

C2
  • http://www.otokoikon.com/vsk9/

Decoy
  • 545earth.com

  • womandigitalrights.net

  • tczxsjw.com

  • tuvantuyensinh24h.com

  • augiocxqo.icu

  • textingtexan.com

  • cheaperwhere.com

  • owe.pink

  • canzonianni90.com

  • explorehisword.com

  • alexaglobe.com

  • comharbookkeeping.com

  • insportseurolatam.com

  • rockplaylists.com

  • masqueareas.com

  • peixunzx.com

  • loudmouse-ent.com

  • medtopharma.com

  • jokersupadte.com

  • axsm0815.com

Targets

    • Target
      Purchase Order 2021 - 00041.exe
    • Size 911KB
    • SHA256 8afb80762bc90479ba2d8f4237e755f78ea789601781615088dfa52f3e87d72a
    • MD5 SHA1 SHA512
    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook Payload

    • Deletes itself

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks