General

  • Target
    Satinalma Siparisi Listesi.exe
  • Size 623KB
  • Sample210708-n7bqnphtfx
  • SHA256 dfca1bf3a2bc630e60ee036b0fd5be55b2f2b44e7dc8d2005b86d763bfc7c8ac
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • formbook

Version
  • 4.1

C2
  • http://www.jakesplacebarbers.com/3nop/

Decoy
  • videohm.com

  • panache-rose.com

  • alnooncars-kw.com

  • trueblue2u.com

  • brussels-cafe.com

  • ip2c.net

  • influenzerr.com

  • rbcoq.com

  • zzful.com

  • drainthe.com

  • sumaholesson.com

  • cursosaprovados.com

  • genotecinc.com

  • dbrulhart.com

  • theapiarystudios.com

  • kensyu-kan.com

  • dkku88.com

  • tikhyper.com

  • aztecnort.com

  • homebrim.com

Targets

    • Target
      Satinalma Siparisi Listesi.exe
    • Size 623KB
    • SHA256 dfca1bf3a2bc630e60ee036b0fd5be55b2f2b44e7dc8d2005b86d763bfc7c8ac
    • MD5 SHA1 SHA512
    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook Payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks