General

  • Target
    обÑ_азцы пÑ_одукции заказать pdf.exe.xz
  • Size 506KB
  • Sample210831-22ck469twa
  • SHA256 260efa00c07e74c629b2284ee64bbc42df7c4bb55d43a4988b72ccd05beae0f0
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • formbook

Version
  • 4.1

Campaign
  • n7ak

C2
  • http://www.kmresults.com/n7ak/

Decoy
  • modischoolcbse.com

  • theneverwinter.com

  • rszkjx-vps-hosting.website

  • fnihil.com

  • 1pbet.com

  • nnowzscorrez.com

  • uaotgvjl.icu

  • starmapsqatar.com

  • ekisilani.com

  • extradeepsheets.com

  • jam-nins.com

  • buranly.com

  • orixentertainment.com

  • rawtech.energy

  • myol.guru

  • utex.club

  • jiapie.com

  • wowig.store

  • wweidlyyl.com

  • systaskautomation.com

Targets

    • Target
      обÑ_азцы пÑ_одукции заказать pdf.exe
    • Size 559KB
    • SHA256 de73d97fc56e19954fbec37b94bc65014305cc288b71ae6889bf37ac193c0333
    • MD5 SHA1 SHA512
    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook Payload

    • Deletes itself

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks