General

  • Target
    a0e6014f72be2a52b6c40021348b429d.exe
  • Size 398KB
  • Sample211124-xa8t6sgfg6
  • SHA256 2b61cfb00cc8a45fdae91c176c8e68be4ac7cefbe0fab5781e5fa44d2ec4ca9f
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • formbook

Version
  • 4.1

Campaign
  • ky0y

C2
  • http://www.thedailybugleblog.com/ky0y/

Decoy
  • towerofgodbsc.com

  • coelests.com

  • beaumontfashion.com

  • buynftarttoken.com

  • manuteno.com

  • cryptos.download

  • coachkevindavis.net

  • meta4developers.com

  • huxle.store

  • contaminacion.online

  • haima168.com

  • korbsizan.store

  • theacademynails.com

  • ordermilanospizzeriamenu.com

  • firearmfx.com

  • metacity.center

  • findmywaytohealthy.com

  • solarbroward.com

  • eusouomeucabelo.com

  • peteytickets.com

Targets

    • Target
      a0e6014f72be2a52b6c40021348b429d.exe
    • Size 398KB
    • SHA256 2b61cfb00cc8a45fdae91c176c8e68be4ac7cefbe0fab5781e5fa44d2ec4ca9f
    • MD5 SHA1 SHA512
    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook Payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks