General

  • Target
    CONTRACT AGREEMENT.exe
  • Size 922KB
  • Sample210422-gbbwm59lae
  • SHA256 c4694ce810c06b60cd032b8ff67964924a0c273a81f8ca5ce55064cf9fb6ec0a
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • formbook

Version
  • 4.1

C2
  • http://www.middlehambooks.com/klf/

Decoy
  • podcastyourvote.com

  • northernlsx.com

  • guide4idiots.com

  • artebythesea.com

  • sapanyc.com

  • livinoutthedreamsco.com

  • thepowersinyou.com

  • protocolmodern.com

  • holdergear.com

  • betteringthehumanexperience.xyz

  • agnostec.com

  • royermaldonado.com

  • wealthtruckingco.com

  • artcode-software.com

  • microsoftpods.com

  • identityofplace.com

  • algoritas.com

  • grandpaurbanfarm.net

  • zahidibr.com

  • flawlessdrinking.com

Targets

    • Target
      CONTRACT AGREEMENT.exe
    • Size 922KB
    • SHA256 c4694ce810c06b60cd032b8ff67964924a0c273a81f8ca5ce55064cf9fb6ec0a
    • MD5 SHA1 SHA512
    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook Payload

    • Deletes itself

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks