General

  • Target

    PI L032452021xxls.exe

  • Size

    706KB

  • Sample

    210915-jan8waaah7

  • MD5

    73c7fda15888b3b6cc025ce3d5f83161

  • SHA1

    78b8467853dc5bdba4dd28a8602902fcc210f67c

  • SHA256

    69394a249833f97289151fa8334f32e0b0467ce4ecb164b0706784fb836136a6

  • SHA512

    dbb943a00e2c24dc0926f36b81409d28789a10d20b8e4043b2545eff1daa74448bc324ada5376e582757ce3db916042747b7939648d8ed102fe2be305ffe872a

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

ergs

C2

http://www.barry-associates.com/ergs/

Decoy

jardineriavilanova.com

highkeyfashionboutique.com

willingtobuyyourhouse.com

ysfno.com

bjkhjzzs.com

hexmotif.com

intentionalerror.com

nuu-foundfreedom.com

catalystspeechservices.com

blackmybail.com

xntaobaozhibo.com

site-sozdat.online

45quisisanadr.com

ipawlove.com

yifa5188.com

admm.email

houseoftealbh.com

scale-biz.com

vdvppt.club

loveandlight.life

Targets

    • Target

      PI L032452021xxls.exe

    • Size

      706KB

    • MD5

      73c7fda15888b3b6cc025ce3d5f83161

    • SHA1

      78b8467853dc5bdba4dd28a8602902fcc210f67c

    • SHA256

      69394a249833f97289151fa8334f32e0b0467ce4ecb164b0706784fb836136a6

    • SHA512

      dbb943a00e2c24dc0926f36b81409d28789a10d20b8e4043b2545eff1daa74448bc324ada5376e582757ce3db916042747b7939648d8ed102fe2be305ffe872a

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook Payload

    • Deletes itself

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks