General

  • Target
    NEW_ORDERS 122020 2 x 40 HQ.exe
  • Size 805KB
  • Sample210508-j1rxhm38vj
  • SHA256 8a116bfcbc1c440c1491513ee9efde46fe7f2e7f24fcdb3f43ee21d0917face7
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • formbook

Version
  • 4.1

C2
  • http://www.supinapp.com/grv/

Decoy
  • morganofatlanta.com

  • vz473.com

  • hengetelt.com

  • bailcally.com

  • virtuosoonline.com

  • tenthousandli.com

  • ohanamascota.com

  • digi-plates.com

  • prismagtech.com

  • we-cinema.com

  • 372680.com

  • smartautoexpert.xyz

  • mrxzg.com

  • apartment-brussels.com

  • reverseincubator.com

  • linkasean.com

  • yummicrabva.com

  • diguchaye.com

  • reaktorfatura.com

  • thecatsaysno.com

Targets

    • Target
      NEW_ORDERS 122020 2 x 40 HQ.exe
    • Size 805KB
    • SHA256 8a116bfcbc1c440c1491513ee9efde46fe7f2e7f24fcdb3f43ee21d0917face7
    • MD5 SHA1 SHA512
    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook Payload

    • Deletes itself

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks