General

  • Target
    scan_0010.pif
  • Size 324KB
  • Sample211202-s77k6adcc7
  • SHA256 f014d9e6a00f7dab0718e5320ebc0185b63c080ab7b3e9d49f0f1eea48c0c09a
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • formbook

Version
  • 4.1

Campaign
  • st28

C2
  • http://www.zymberzuzaku.com/st28/

Decoy
  • ratusejagad.com

  • huabei86.com

  • bolan55.com

  • re-designingwork.com

  • doanhyduc.net

  • hutbephot-hanoi2.online

  • gamenfr.net

  • keystosmile.com

  • halwyat.online

  • kliktshirts.com

  • nasirqadri.com

  • designinframe.com

  • workation.global

  • ges-llc.biz

  • ropsstyle.online

  • sociallenzer.com

  • daxvly.xyz

  • paradigmtrading.net

  • niceassetnsirs.com

  • enzofineart.com

Targets

    • Target
      scan_0010.pif
    • Size 324KB
    • SHA256 f014d9e6a00f7dab0718e5320ebc0185b63c080ab7b3e9d49f0f1eea48c0c09a
    • MD5 SHA1 SHA512
    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook Payload

    • Deletes itself

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks