General

  • Target
    Quotation.exe
  • Size 955KB
  • Sample210506-6prpa16v36
  • SHA256 49a4412c27e5eafc4c4365a2b2aeb962d6bf25849ab58d4e7eeb25fcfb934dcd
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • formbook

Version
  • 4.1

C2
  • http://www.bluesmartsockets.com/mgl/

Decoy
  • credittipswebinar.com

  • pewpewlab.com

  • teamcreativconsultanting.com

  • bsf.xyz

  • youthwork.support

  • fmoues.com

  • ourcardoctor.com

  • wwwmoticarshub.net

  • bellevuedogroomer.com

  • vorazshop.com

  • sorteo.gratis

  • shalinihome.xyz

  • myschoolmgt.net

  • we73theunityprojectband.com

  • xn--n8jx07hkhe20b9k751g.com

  • gregrunnebaum.com

  • asnomayritys.com

  • iremgulmez.com

  • the1099guy.com

  • reviewscandy.net

Targets

    • Target
      Quotation.exe
    • Size 955KB
    • SHA256 49a4412c27e5eafc4c4365a2b2aeb962d6bf25849ab58d4e7eeb25fcfb934dcd
    • MD5 SHA1 SHA512
    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook Payload

    • Deletes itself

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks