General

  • Target
    48f264ba784a88ef38095ab61b7caa55.exe
  • Size 238KB
  • Sample210331-lzpzjs2k7x
  • SHA256 5755f598a66b494a7692bfefd7ff348d7d1d8ae6fdd7e799bdfe7f6cbf642c33
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • formbook

C2
  • http://www.stockproductionmusic.works/gzh/

Decoy
  • banken-api.management

  • thecleaningenthusiast.com

  • ytownbbqco.com

  • investmentinsourcing.net

  • naijasm.com

  • 224buildingservices.com

  • lossentidosdelatierra.com

  • puntocommx.com

  • grlcgang.com

  • forasacredlife.com

  • travelerglobalexperience.com

  • liquor247usa.com

  • russianfraud.com

  • scarslice.com

  • qiniu-power.com

  • 5vid.lat

  • poolotz.com

  • swagychopshop.com

  • 0086tcd.com

  • thesaltybetty.com

Targets

    • Target
      48f264ba784a88ef38095ab61b7caa55.exe
    • Size 238KB
    • SHA256 5755f598a66b494a7692bfefd7ff348d7d1d8ae6fdd7e799bdfe7f6cbf642c33
    • MD5 SHA1 SHA512
    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook Payload

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks