General

  • Target
    257a36fdd79cbf165caeda4a1efe458034d670b71060693fdb0d2a1bf0489aa5
  • Size 687KB
  • Sample210816-tbm2l9eb3n
  • SHA256 257a36fdd79cbf165caeda4a1efe458034d670b71060693fdb0d2a1bf0489aa5
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • formbook

Version
  • 4.1

Campaign
  • dxe

C2
  • http://www.knighttechinca.com/dxe/

Decoy
  • sardarfarm.com

  • 959tremont.com

  • privat-livecam.net

  • ansel-homebakery.com

  • joysupermarket.com

  • peninsulamatchmakers.net

  • northsytyle.com

  • radioconexaoubermusic.com

  • relocatingrealtor.com

  • desyrnan.com

  • onlinehoortoestel.online

  • enpointe.online

  • rvvikings.com

  • paulpoirier.com

  • shitarpa.net

  • kerneis.net

  • rokitreach.com

  • essentiallygaia.com

  • prestiged.net

  • fuerzaagavera.com

Targets

    • Target
      257a36fdd79cbf165caeda4a1efe458034d670b71060693fdb0d2a1bf0489aa5
    • Size 687KB
    • SHA256 257a36fdd79cbf165caeda4a1efe458034d670b71060693fdb0d2a1bf0489aa5
    • MD5 SHA1 SHA512
    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook Payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks