General

  • Target
    file.exe
  • Size 185KB
  • Sample210928-qcmldscae4
  • SHA256 dcee55c9896715272cfd344a7a62fe6c5dbe0e61d7d8548beeda46c15bd8e07c
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • formbook

Version
  • 4.1

Campaign
  • j3gd

C2
  • http://www.fracturedmindset.com/j3gd/

Decoy
  • lpumanagement.com

  • seafreshindia.com

  • progetto-energia.com

  • anthonyconstantis.com

  • wuhanyinyue.com

  • rimflso.com

  • zayedcenter.net

  • toggturkish.com

  • grayshottspalife.com

  • migliorarelasalute.website

  • micj1426.com

  • salicosmetic.com

  • renospro.com

  • fantasiegeschichten.com

  • velvetgoo.art

  • chasernt.online

  • mojogrup.com

  • beer-app.com

  • workitsexyguru.com

  • rmhansonfreelancewriting.com

Targets

    • Target
      file.exe
    • Size 185KB
    • SHA256 dcee55c9896715272cfd344a7a62fe6c5dbe0e61d7d8548beeda46c15bd8e07c
    • MD5 SHA1 SHA512
    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook Payload

    • Deletes itself

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks