General

  • Target
    Proforma Fatura INV98767894.PDF.exe
  • Size 810KB
  • Sample210426-d2rdqmc2ys
  • SHA256 738ab100dc0c1db979bc68b02da95d90f59b0da83a5f4fb89d6c140ffac1517b
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • formbook

Version
  • 4.1

C2
  • http://www.supinapp.com/grv/

Decoy
  • morganofatlanta.com

  • vz473.com

  • hengetelt.com

  • bailcally.com

  • virtuosoonline.com

  • tenthousandli.com

  • ohanamascota.com

  • digi-plates.com

  • prismagtech.com

  • we-cinema.com

  • 372680.com

  • smartautoexpert.xyz

  • mrxzg.com

  • apartment-brussels.com

  • reverseincubator.com

  • linkasean.com

  • yummicrabva.com

  • diguchaye.com

  • reaktorfatura.com

  • thecatsaysno.com

Targets

    • Target
      Proforma Fatura INV98767894.PDF.exe
    • Size 810KB
    • SHA256 738ab100dc0c1db979bc68b02da95d90f59b0da83a5f4fb89d6c140ffac1517b
    • MD5 SHA1 SHA512
    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook Payload

    • Deletes itself

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks