General

  • Target
    proforma invoice_pdf_____________________________.exe
  • Size 1.0MB
  • Sample210924-qwt5kshbc9
  • SHA256 137bbdb0a6a00a9167dff5cb670ec17aab82ae50392e12b1cdb6a08110d75285
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • formbook

Version
  • 4.1

Campaign
  • ajki

C2
  • http://www.midwestamericanwoman.com/ajki/

Decoy
  • elborivegano.com

  • jacksbookbuddies.com

  • gentciu.com

  • lovetattoonorteguadalix.com

  • dahlkar.com

  • hjobjiihna.club

  • narccar.com

  • noexcuseadventure.com

  • mortongroverealestateinfo.com

  • pursuegoodtimes.com

  • becomearepresentativetoday.com

  • 20bagger.com

  • lowestprices.space

  • qzgay.com

  • thegoenkapost.com

  • glassdooronline.com

  • quantizesoftware.com

  • bayleighmphotography.com

  • hzmm97.com

  • theexoticbox.com

Targets

    • Target
      proforma invoice_pdf_____________________________.exe
    • Size 1.0MB
    • SHA256 137bbdb0a6a00a9167dff5cb670ec17aab82ae50392e12b1cdb6a08110d75285
    • MD5 SHA1 SHA512
    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook Payload

    • Deletes itself

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks