General

  • Target
    deme onaylama.exe
  • Size 480KB
  • Sample210914-kg5d4sfdb3
  • SHA256 9bd0e2f3db2198a11805aedadf2ef3e75aba1c02f1bbe0fe880eb71bb6a2651b
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • formbook

Version
  • 4.1

Campaign
  • vd9n

C2
  • http://www.constructioncleanup.pro/vd9n/

Decoy
  • theunwrappedcollective.com

  • seckj-ic.com

  • tyresandover.com

  • thetrophyworld.com

  • fonggrconstruction.com

  • hopiproject.com

  • sktitle.com

  • charlotteobscurer.com

  • qjuhe.com

  • girlzglitter.com

  • createmylawn.com

  • hempcbgpill.com

  • zzdfdzkj.com

  • shreehariessential.com

  • 226sm.com

  • getcupscall.com

  • neuralviolin.com

  • sanskaar.life

  • xn--fhqrm54yyukopc.com

  • togetherx4fantasy5star.today

Targets

    • Target
      deme onaylama.exe
    • Size 480KB
    • SHA256 9bd0e2f3db2198a11805aedadf2ef3e75aba1c02f1bbe0fe880eb71bb6a2651b
    • MD5 SHA1 SHA512
    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook Payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks