General

  • Target
    7f3fc7d086447a7e15e0d32bdd885cbc.exe
  • Size 270KB
  • Sample210421-13cs71vw2j
  • SHA256 ce2ca323cae4838375c60305a3706e6828ab9fd8e30b65b1d0f4c87dbce0f29b
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • formbook

Version
  • 4.1

C2
  • http://www.shoprodeovegas.com/xcl/

Decoy
  • sewingtherose.com

  • thesmartshareholder.com

  • afasyah.com

  • marolamusic.com

  • lookupgeorgina.com

  • plataforyou.com

  • dijcan.com

  • pawtyparcels.com

  • interprediction.com

  • fairerfinancehackathon.net

  • thehmnshop.com

  • jocelynlopez.com

  • launcheffecthouston.com

  • joyeveryminute.com

  • spyforu.com

  • ronerasanjuan.com

  • gadgetsdesi.com

  • nmrconsultants.com

  • travellpod.com

  • ballparksportscards.com

Targets

    • Target
      7f3fc7d086447a7e15e0d32bdd885cbc.exe
    • Size 270KB
    • SHA256 ce2ca323cae4838375c60305a3706e6828ab9fd8e30b65b1d0f4c87dbce0f29b
    • MD5 SHA1 SHA512
    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook Payload

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks