General

  • Target
    Lista de вrdenes de compra.pdf.exe
  • Size 863KB
  • Sample211108-x3scwsaaem
  • SHA256 8d2178f66a2f38749fe7a14664a5d360a42394720903651aea85a5d96cfdbc41
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • formbook

Version
  • 4.1

Campaign
  • dv9n

C2
  • http://www.elianedefalco.com/dv9n/

Decoy
  • nblvqing.com

  • delmegebuildingproducts.com

  • xiongba8.com

  • latuawebreputation.online

  • nowcloud.tech

  • cckghs.com

  • tradeoo.ltd

  • ppapo.com

  • tphoaphuongdo.club

  • whitefoxy.site

  • bottle-sentences.net

  • computersewa.com

  • lushberryholidays.com

  • motobotz.com

  • shadurj.com

  • amazonlexdeveloper.com

  • shunli178.xyz

  • sjzzlmh.com

  • 6eu09rp.xyz

  • novinmes.com

Targets

    • Target
      Lista de вrdenes de compra.pdf.exe
    • Size 863KB
    • SHA256 8d2178f66a2f38749fe7a14664a5d360a42394720903651aea85a5d96cfdbc41
    • MD5 SHA1 SHA512
    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • suricata: ET MALWARE FormBook CnC Checkin (GET)

      suricata: ET MALWARE FormBook CnC Checkin (GET)

    • Formbook Payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks