General

  • Target
    6b76b31674beb7e8aa442834dacd9b8f
  • Size 555KB
  • Sample211109-p7hegscdan
  • SHA256 02a852aaa839120b0e557629b63a754cb302ebe2f11275d3e4fb68f4f1e70532
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • formbook

Version
  • 4.1

Campaign
  • nqm8

C2
  • http://www.mmsite.site/nqm8/

Decoy
  • gr8leiloes.com

  • workali.com

  • tom641220480.online

  • metaversehome.tech

  • aljinternationalcorp.com

  • drofekt.com

  • landmanagementdirtworksnwar.com

  • liaslaton.com

  • hanswelliot.com

  • sterling2.xyz

  • metatock.com

  • tnbankauctionproperties.com

  • 366466.com

  • g1ft-portal.net

  • highlandsdg.com

  • letsgorebranding.com

  • tc76.xyz

  • colo2022.xyz

  • reikicertificationcourses.info

  • metawks.com

Targets

    • Target
      6b76b31674beb7e8aa442834dacd9b8f
    • Size 555KB
    • SHA256 02a852aaa839120b0e557629b63a754cb302ebe2f11275d3e4fb68f4f1e70532
    • MD5 SHA1 SHA512
    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • suricata: ET MALWARE FormBook CnC Checkin (GET)

      suricata: ET MALWARE FormBook CnC Checkin (GET)

    • Formbook Payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks