General

  • Target
    HG284-2021_03_31.pdf.exe
  • Size 760KB
  • Sample210331-957t5q4kp2
  • SHA256 bc0cc9f45e5a3b9f2f1815c4787849ebd8ab71d72aca809b687bc462ec9b5899
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • formbook

C2
  • http://www.profit-maximisation.com/g7b/

Decoy
  • conectadocr.com

  • traumatic-arrest.com

  • financialfitnessspa.com

  • tinnitusofficial.club

  • upward-holdings.com

  • instagramhelp-me.com

  • annabelsasia.com

  • bbwtrip.com

  • coloradodomain.com

  • coachparapadres.com

  • tootandscoot.com

  • homemstreet.com

  • nmresortproperty.com

  • towerskyresort.com

  • touchofclasspropertiesllc.com

  • intilook.com

  • mrd-photography.com

  • thesalesarcade.com

  • reddirect.net

  • j-hn.com

Targets

    • Target
      HG284-2021_03_31.pdf.exe
    • Size 760KB
    • SHA256 bc0cc9f45e5a3b9f2f1815c4787849ebd8ab71d72aca809b687bc462ec9b5899
    • MD5 SHA1 SHA512
    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook Payload

    • Deletes itself

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks