General

  • Target

    882d1b405632e01ab063253e2a0f647ff2587fe879e6b90e03b59226e36c8fe8

  • Size

    502KB

  • Sample

    211129-1mnxbafgg5

  • MD5

    e96932ebdf43aba69c5cdcebc89413cb

  • SHA1

    5051ceeb14e13c31f64df10844b65fea185caf44

  • SHA256

    882d1b405632e01ab063253e2a0f647ff2587fe879e6b90e03b59226e36c8fe8

  • SHA512

    6cb93514c2d240de42a321bdd579b34091b65e6615b23924602e7168b9ac2f3a32c146d415832c2d98d9ad1b4367a829e5ebc2c0c4e862f361b54de5edcc055a

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

vngb

C2

http://www.gvlc0.club/vngb/

Decoy

omertalasvegas.com

payyep.com

modasportss.com

gestionestrategicadl.com

teamolemiss.club

geektranslate.com

versatileventure.com

athletic-hub.com

vitanovaretreats.com

padison8t.com

tutoeasy.com

ediblewholesale.com

kangrungao.com

satode.com

prohibitionfeeds.com

getmorevacations.com

blinkworldbeauty.com

kdlabsallr.com

almanasef.com

transportationservicellc.com

Targets

    • Target

      882d1b405632e01ab063253e2a0f647ff2587fe879e6b90e03b59226e36c8fe8

    • Size

      502KB

    • MD5

      e96932ebdf43aba69c5cdcebc89413cb

    • SHA1

      5051ceeb14e13c31f64df10844b65fea185caf44

    • SHA256

      882d1b405632e01ab063253e2a0f647ff2587fe879e6b90e03b59226e36c8fe8

    • SHA512

      6cb93514c2d240de42a321bdd579b34091b65e6615b23924602e7168b9ac2f3a32c146d415832c2d98d9ad1b4367a829e5ebc2c0c4e862f361b54de5edcc055a

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook Payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks