General

  • Target
    a06a7f5eebcc8775298bc39c7a8a8467.exe
  • Size 1.0MB
  • Sample210325-3acmpsalgs
  • SHA256 8abbb82177795958ea53d73a1bbec66ee19065039c7c48d37d3d6b02bd92ff1e
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • formbook

C2
  • http://www.devintagefanaat.com/gbc/

Decoy
  • norsk.guru

  • avidreadershop.com

  • serhancoop.com

  • miamimetalmen.com

  • woodenbenchesforsale.com

  • nationalrealstate.com

  • grandesuccesso.net

  • oldsoulsurboards.com

  • thrbakeryroomkw.com

  • alternativetouber.com

  • 1645pacific1a.com

  • 51hamahama.com

  • scottishhiking.com

  • thefieldtrialer.com

  • majordogear.com

  • 6nly.com

  • pharmacistscbd.com

  • arpy.world

  • exyu-hosting.com

  • peterboroughweddings.com

Targets

    • Target
      a06a7f5eebcc8775298bc39c7a8a8467.exe
    • Size 1.0MB
    • SHA256 8abbb82177795958ea53d73a1bbec66ee19065039c7c48d37d3d6b02bd92ff1e
    • MD5 SHA1 SHA512
    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook Payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks