General

  • Target
    Scan Copy.exe
  • Size 587KB
  • Sample211118-rmw39ahae6
  • SHA256 5dad6b254fb40bb4c090f5048e07da656821a4b6b163c6548287c3d91dcfda45
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • formbook

Version
  • 4.1

Campaign
  • b3n1

C2
  • http://www.teslabotnews.com/b3n1/

Decoy
  • alexandragrows.com

  • shellload.com

  • stanleyrorke.com

  • glasurit.us

  • facebookismetaverse.com

  • astoundingaffairs.com

  • facom.us

  • dysonsaleoutlet.us

  • obtengaunitedhealthcare.com

  • sebastianroofrepairs.com

  • saltvent.com

  • littleonesclub.com

  • webamazoncardshopmail.xyz

  • lutam.xyz

  • myfirstpsgame.com

  • comline.cloud

  • valueinsightfororacle.com

  • congregacionansestral.com.co

  • paypal-uk.xyz

  • facebookversuzmeta.com

Targets

    • Target
      Scan Copy.exe
    • Size 587KB
    • SHA256 5dad6b254fb40bb4c090f5048e07da656821a4b6b163c6548287c3d91dcfda45
    • MD5 SHA1 SHA512
    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook Payload

    • Deletes itself

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks