General

  • Target
    DHL_AWB_NO#907853880911.exe
  • Size 911KB
  • Sample210712-2pzaaeg89a
  • SHA256 1640d521a0e5aff2aeb9eb892c8b19d0897e22c73940c394a5cb12af271de6ec
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • formbook

Version
  • 4.1

C2
  • http://www.bitcoin-noticias.com/fw6/

Decoy
  • rashtriyasanghsewak.com

  • filestree.cloud

  • penoner.com

  • owliwant.com

  • elkincook.com

  • jhac16kaizencollection.com

  • shalomdentalavenue.com

  • hotelsbytheweek.com

  • cookwithchefcari.com

  • threattenterprises.com

  • sanookna.com

  • tlsbuilders.com

  • softandhardshop.com

  • ppr419.com

  • powertexinc.info

  • businessandhr.com

  • yiliao2020.com

  • eiman-pro.com

  • rhondarothrealtor.com

  • junk-service.com

Targets

    • Target
      DHL_AWB_NO#907853880911.exe
    • Size 911KB
    • SHA256 1640d521a0e5aff2aeb9eb892c8b19d0897e22c73940c394a5cb12af271de6ec
    • MD5 SHA1 SHA512
    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook Payload

    • Deletes itself

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks