General

  • Target
    Price list pdf.exe
  • Size 766KB
  • Sample210331-kgkzkr16d2
  • SHA256 3df2cc414d6cef0d973d0f47141a13be183a9da46e0455940affe5d24b9c2f9f
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • formbook

C2
  • http://www.gloomyca.com/chue/

Decoy
  • hairdewproducts.com

  • whssboys.net

  • visual-promotions.com

  • alsgotyaexteriorcleaning.com

  • conwayconsultant.com

  • sjlartistrydesign.info

  • organicroomservice.com

  • elatedscents.com

  • selfauthering.com

  • variablemonsters.com

  • thedietcop.com

  • openhouseshamptonroads.com

  • tyrantthemes.com

  • trumppowercatamarans.com

  • yznx.xyz

  • jshfoodpantry.com

  • larmealoeil.com

  • biztradelines.com

  • axawinterthur.sucks

  • inspiredtravels.net

Targets

    • Target
      Price list pdf.exe
    • Size 766KB
    • SHA256 3df2cc414d6cef0d973d0f47141a13be183a9da46e0455940affe5d24b9c2f9f
    • MD5 SHA1 SHA512
    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook Payload

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks