General

  • Target
    Halkbank_Ekstre_20210708_0709789_405251-PDF.exe
  • Size 743KB
  • Sample210708-2xys5tlpza
  • SHA256 d457980cebdbfd785a77b0d09249f5bc8cca708f5b5e7fe607f1b538faf977c4
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • formbook

Version
  • 4.1

C2
  • http://www.setuseny.site/wz6a/

Decoy
  • commonebisu.com

  • onlinedatingforyou.com

  • nomoreink.com

  • directcare.doctor

  • protego1.com

  • buvettechamonix.com

  • dissertationshelp.net

  • theawakenedmother.life

  • leonwickham.com

  • renaultstoreiran.com

  • lsxwsj.com

  • uniontattoosupply.com

  • herfitnessandbeauty.com

  • jesselynleephotography.com

  • imaginebyccp.com

  • athomeproductive.com

  • laratome.com

  • smoothsailingexpress.com

  • freedrumlessons4u.com

  • easylivego.com

Targets

    • Target
      Halkbank_Ekstre_20210708_0709789_405251-PDF.exe
    • Size 743KB
    • SHA256 d457980cebdbfd785a77b0d09249f5bc8cca708f5b5e7fe607f1b538faf977c4
    • MD5 SHA1 SHA512
    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook Payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks