General

  • Target
    6092f193b2b1a3b8f7c00482aff6243f
  • Size 261KB
  • Sample211201-vyqmdsecen
  • SHA256 f383f40cc25197aa00a470f4b549f6da97293ebd87dd80b099d59d5fc7a2dab4
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • formbook

Version
  • 4.1

Campaign
  • cf27

C2
  • http://www.itesparii.quest/cf27/

Decoy
  • sas009.com

  • moodior.com

  • htxhaivanquynhnhai.com

  • clutch-car.com

  • lumgf.xyz

  • rachelnebozuk.com

  • myke.codes

  • megaprotorgss.club

  • 99soles.com

  • robinsongrewalcpa.com

  • thehourlymotherpodcast.com

  • daxvly.xyz

  • poygik.store

  • ctws-llc.com

  • itsbrunosworld.com

  • jewelsbynaya.com

  • bba-seguiridad.com

  • fuchspack.info

  • skidxllc.com

  • ghi9.com

Targets

    • Target
      6092f193b2b1a3b8f7c00482aff6243f
    • Size 261KB
    • SHA256 f383f40cc25197aa00a470f4b549f6da97293ebd87dd80b099d59d5fc7a2dab4
    • MD5 SHA1 SHA512
    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook Payload

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks