General

  • Target
    INV-210318L.exe
  • Size 458KB
  • Sample210401-69pfe1c5xn
  • SHA256 6c2f5bf673b3bbc31cf425259cd5a0262094e85a8bed03714c7b39712efc4beb
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • formbook

C2
  • http://www.otokoikon.com/vsk9/

Decoy
  • 545earth.com

  • womandigitalrights.net

  • tczxsjw.com

  • tuvantuyensinh24h.com

  • augiocxqo.icu

  • textingtexan.com

  • cheaperwhere.com

  • owe.pink

  • canzonianni90.com

  • explorehisword.com

  • alexaglobe.com

  • comharbookkeeping.com

  • insportseurolatam.com

  • rockplaylists.com

  • masqueareas.com

  • peixunzx.com

  • loudmouse-ent.com

  • medtopharma.com

  • jokersupadte.com

  • axsm0815.com

Targets

    • Target
      INV-210318L.exe
    • Size 458KB
    • SHA256 6c2f5bf673b3bbc31cf425259cd5a0262094e85a8bed03714c7b39712efc4beb
    • MD5 SHA1 SHA512
    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook Payload

    • Deletes itself

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks