General

  • Target
    Invoicee.exe
  • Size 511KB
  • Sample210408-pr7qd72v6e
  • SHA256 9b9218d3692f38654cde45d5a9b01a6d5cb83aa5442c286fc4e073a6348e08d1
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • formbook

Version
  • 4.1

C2
  • http://www.boldoval.com/ch65/

Decoy
  • jobhuizhan.com

  • madeinarcade.com

  • germanyromeo.club

  • gsxguru.com

  • widedepot.com

  • aboutthemwheels.com

  • roboticmarkets.com

  • triy.club

  • primetrust.foundation

  • raulmendez.design

  • reddingvideos.com

  • cyclingsunglassestrend.com

  • sacredstarmystic.com

  • juxrams.info

  • multacolors.com

  • focusonevolving.com

  • kimmoniqueboutique.com

  • palomadepapel.com

  • stanleywatches.com

  • lafamiliagomez.com

Targets

    • Target
      Invoicee.exe
    • Size 511KB
    • SHA256 9b9218d3692f38654cde45d5a9b01a6d5cb83aa5442c286fc4e073a6348e08d1
    • MD5 SHA1 SHA512
    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook Payload

    • Deletes itself

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks