General

  • Target
    Сатып алуға тапсырыс парағы.pdf.exe
  • Size 445KB
  • Sample211110-fs53kadecr
  • SHA256 9d37fb95eefc5396c3aee5e5c4525b373821cd151f7fc5b2d3805f0fb0056a4a
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • formbook

Version
  • 4.1

Campaign
  • dv9n

C2
  • http://www.elianedefalco.com/dv9n/

Decoy
  • nblvqing.com

  • delmegebuildingproducts.com

  • xiongba8.com

  • latuawebreputation.online

  • nowcloud.tech

  • cckghs.com

  • tradeoo.ltd

  • ppapo.com

  • tphoaphuongdo.club

  • whitefoxy.site

  • bottle-sentences.net

  • computersewa.com

  • lushberryholidays.com

  • motobotz.com

  • shadurj.com

  • amazonlexdeveloper.com

  • shunli178.xyz

  • sjzzlmh.com

  • 6eu09rp.xyz

  • novinmes.com

Targets

    • Target
      Сатып алуға тапсырыс парағы.pdf.exe
    • Size 445KB
    • SHA256 9d37fb95eefc5396c3aee5e5c4525b373821cd151f7fc5b2d3805f0fb0056a4a
    • MD5 SHA1 SHA512
    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • suricata: ET MALWARE FormBook CnC Checkin (GET)

      suricata: ET MALWARE FormBook CnC Checkin (GET)

    • Formbook Payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks