General

  • Target
    Yeni siparis ekteki listede.exe
  • Size 962KB
  • Sample210902-fp58f1cz7j
  • SHA256 87946dcd976eb13af37e24ff68e36a03d2f46a9ae474f336207cf03cbbb0b508
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • formbook

Version
  • 4.1

Campaign
  • 3nop

C2
  • http://www.jakesplacebarbers.com/3nop/

Decoy
  • videohm.com

  • panache-rose.com

  • alnooncars-kw.com

  • trueblue2u.com

  • brussels-cafe.com

  • ip2c.net

  • influenzerr.com

  • rbcoq.com

  • zzful.com

  • drainthe.com

  • sumaholesson.com

  • cursosaprovados.com

  • genotecinc.com

  • dbrulhart.com

  • theapiarystudios.com

  • kensyu-kan.com

  • dkku88.com

  • tikhyper.com

  • aztecnort.com

  • homebrim.com

Targets

    • Target
      Yeni siparis ekteki listede.exe
    • Size 962KB
    • SHA256 87946dcd976eb13af37e24ff68e36a03d2f46a9ae474f336207cf03cbbb0b508
    • MD5 SHA1 SHA512
    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook Payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks