General

  • Target
    AWB_NO_9284730932.exe
  • Size 521KB
  • Sample211124-ree5rsgad6
  • SHA256 df70c8209f25283b9f315676eb12c7ea09c683501386f1290e347f70fb4079ff
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • formbook

Version
  • 4.1

Campaign
  • fl9w

C2
  • http://www.makheads.com/fl9w/

Decoy
  • alicebowtique.com

  • way2discounts.com

  • chihangjingmi.com

  • exmcap.com

  • artisquid.com

  • financelbs.com

  • tresholdnetwork.com

  • www-9367.com

  • funtripsouthindia.com

  • ibew-neca.com

  • elqaunim.com

  • gbetapi.com

  • turkthee.com

  • greaterdetroitrealtyexpert.com

  • springhousevet.com

  • dgjt1688.com

  • broomsweeping.com

  • bettyfred.xyz

  • afmcabnot6.xyz

  • toylandmetaverse.com

Targets

    • Target
      AWB_NO_9284730932.exe
    • Size 521KB
    • SHA256 df70c8209f25283b9f315676eb12c7ea09c683501386f1290e347f70fb4079ff
    • MD5 SHA1 SHA512
    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook Payload

    • Deletes itself

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks