General

  • Target

    0987654345690987654356787654.exe

  • Size

    647KB

  • Sample

    210510-lwda244ft6

  • MD5

    8de5c116b2cde266b707582ade061a55

  • SHA1

    21a6a11acfcd3c975efacf067d8b9db96072246c

  • SHA256

    2efbb8abb0745a78dba6bdd6137619d948b47b352ab95732f00471831f95ad6d

  • SHA512

    f50236d58dfb2c0670101b97e57fb780a48e0cddf34a60d28057f5cf9e6cfe91d1e87851c08de00480750977bb503596aedb51b1c06fea80a2057f4c1f4536fa

Malware Config

Extracted

Family

formbook

Version

4.1

C2

http://www.btyaning.com/mpr/

Decoy

314278.com

tantradarsan.com

benefitlmc.com

enterprisedisruptors.com

shoptesa.com

yourvirtualjob.com

queencz.com

meddypro.com

sarahcasias.com

mhrcbxnuwf.com

elgoldetuvida.com

veeyvmgwh.icu

virtualpos.info

handymanlothian.com

shopbond.com

21att.com

fluffbylaww.com

mcintyreanddodd.com

familycq.com

spareprelude.life

Targets

    • Target

      0987654345690987654356787654.exe

    • Size

      647KB

    • MD5

      8de5c116b2cde266b707582ade061a55

    • SHA1

      21a6a11acfcd3c975efacf067d8b9db96072246c

    • SHA256

      2efbb8abb0745a78dba6bdd6137619d948b47b352ab95732f00471831f95ad6d

    • SHA512

      f50236d58dfb2c0670101b97e57fb780a48e0cddf34a60d28057f5cf9e6cfe91d1e87851c08de00480750977bb503596aedb51b1c06fea80a2057f4c1f4536fa

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook Payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks