General

  • Target
    Swift.exe
  • Size 733KB
  • Sample210905-klfljshde8
  • SHA256 e99ee0d03ae293aec74c31a6db628d9fe12be9699365ebf71de4b2bf6e8ca0d5
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • formbook

Version
  • 4.1

Campaign
  • pm7s

C2
  • http://www.rafaelcristino.com/pm7s/

Decoy
  • angrypeacocks.site

  • theindependentartlable.com

  • coachingforthewin.com

  • localbizsc.com

  • drive-a-supercar.com

  • mewsette.com

  • scinuh.com

  • gurugramaffordablehomes.com

  • riamedefarm.com

  • richfitzfashions.com

  • u9j1o.info

  • dife-rent.com

  • talesfromthequadrat.com

  • dandfmotors.com

  • springtexasdentist.com

  • gobakala.store

  • earlyeducationglobal.com

  • sdrxsb.site

  • dreamlifebiz.com

  • theurbancaveshop.com

Targets

    • Target
      Swift.exe
    • Size 733KB
    • SHA256 e99ee0d03ae293aec74c31a6db628d9fe12be9699365ebf71de4b2bf6e8ca0d5
    • MD5 SHA1 SHA512
    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook Payload

    • Deletes itself

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks