General

  • Target
    Payment_swift advice.exe
  • Size 597KB
  • Sample211029-y2pfaaeah2
  • SHA256 b94f5b293f83458293e899d5a76ca936cc4ea5d79913e3792cc25f08fda1a147
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • formbook

Version
  • 4.1

Campaign
  • snr6

C2
  • http://www.reynbetgirisi.com/snr6/

Decoy
  • jjglassmi1.com

  • vpsseattle.com

  • drfllc.top

  • staycoolonline.com

  • eptlove.com

  • solusimatasehat.site

  • ionrarecharlestonproperties.com

  • b3eflucg.xyz

  • tvchosun-usa.com

  • mmahzxwzsadqlshop.life

  • gospelimport.com

  • demoapps.website

  • jackburst54.com

  • 99rocket.education

  • ccbwithbri.com

  • trapperairsoft.com

  • useroadly.com

  • ralphlaurenonline-nl.com

  • loanmaster4u.com

  • champ-beauty-tomigaoka-nail.com

Targets

    • Target
      Payment_swift advice.exe
    • Size 597KB
    • SHA256 b94f5b293f83458293e899d5a76ca936cc4ea5d79913e3792cc25f08fda1a147
    • MD5 SHA1 SHA512
    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook Payload

    • Deletes itself

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks