General

  • Target
    6660020210712_0-00010.XLS.exe
  • Size 819KB
  • Sample210713-2ra5nexcg2
  • SHA256 031af74c61339ca40eda7563268d9e2e2803064c141d3c46eb20acad3764f4cc
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • formbook

Version
  • 4.1

C2
  • http://www.setuseny.site/wz6a/

Decoy
  • commonebisu.com

  • onlinedatingforyou.com

  • nomoreink.com

  • directcare.doctor

  • protego1.com

  • buvettechamonix.com

  • dissertationshelp.net

  • theawakenedmother.life

  • leonwickham.com

  • renaultstoreiran.com

  • lsxwsj.com

  • uniontattoosupply.com

  • herfitnessandbeauty.com

  • jesselynleephotography.com

  • imaginebyccp.com

  • athomeproductive.com

  • laratome.com

  • smoothsailingexpress.com

  • freedrumlessons4u.com

  • easylivego.com

Targets

    • Target
      6660020210712_0-00010.XLS.exe
    • Size 819KB
    • SHA256 031af74c61339ca40eda7563268d9e2e2803064c141d3c46eb20acad3764f4cc
    • MD5 SHA1 SHA512
    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook Payload

    • Deletes itself

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks