General

  • Target

    Materialliste für Angebot.exe

  • Size

    928KB

  • Sample

    210511-mk5g1zbjpn

  • MD5

    b4aba542c1d33eb248781de4ea91b3bc

  • SHA1

    030778f8206c86a1e079958bf02a0747817c89f1

  • SHA256

    fed5d1810dc0b8de09e6171fe452981207cf0464d9a6dcd114a1fe9e2c1759ad

  • SHA512

    ba5b8d82ed08d1719cabd232e716080d6e72f8743a7c74e8d09386360c3d22db9c1849c112e2d612d2aabf40aa2d210dc47f06ecd35457ce6e6fe687d7d18f7e

Malware Config

Extracted

Family

formbook

Version

4.1

C2

http://www.tazmgloli.icu/mbg/

Decoy

rouskysnanofiltrem.com

netsoftex.website

ap-hardware.com

michaelroselman.com

thegentlefamily.com

merzberg.com

mhteam.club

universallypc.com

xn--bm4bzth4kbok9nc.com

torontogreekevents.com

atlirmarisa.com

coludelegance.com

hooksandhounds.com

bobbymartz.com

empresseventsco.com

littlespinkco.com

kstilo.com

guestemails.com

thespiritoftheviking.com

haveyoueverseenawhale.com

Targets

    • Target

      Materialliste für Angebot.exe

    • Size

      928KB

    • MD5

      b4aba542c1d33eb248781de4ea91b3bc

    • SHA1

      030778f8206c86a1e079958bf02a0747817c89f1

    • SHA256

      fed5d1810dc0b8de09e6171fe452981207cf0464d9a6dcd114a1fe9e2c1759ad

    • SHA512

      ba5b8d82ed08d1719cabd232e716080d6e72f8743a7c74e8d09386360c3d22db9c1849c112e2d612d2aabf40aa2d210dc47f06ecd35457ce6e6fe687d7d18f7e

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook Payload

    • Deletes itself

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks