General

  • Target
    PO21120008.PDF.exe
  • Size 1.0MB
  • Sample211209-j81dssbba3
  • SHA256 bf4e018e1442fb7815901e53bccc699ee5634e2fcc3ba73327e123ae3d89a65b
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • formbook

Version
  • 4.1

Campaign
  • gr1c

C2
  • http://www.illusiontrick.com/gr1c/

Decoy
  • soakyourgrains.com

  • duwego.com

  • aenkdesign.com

  • bikabbziu.xyz

  • thesawyerlegacy.com

  • koreanmodelbj.xyz

  • exceed-standards.com

  • syirsve.com

  • sachisushimontreal.com

  • thegalwaykitchen.com

  • accarwash-hub.com

  • connectwithmentor.com

  • luftfundament.online

  • ibrahimkaracan.com

  • biggersinsurance.com

  • desellon.com

  • tvnewscloset.com

  • digital-dre.com

  • ingocg.com

  • fernanda-ortiz.com

Targets

    • Target
      PO21120008.PDF.exe
    • Size 1.0MB
    • SHA256 bf4e018e1442fb7815901e53bccc699ee5634e2fcc3ba73327e123ae3d89a65b
    • MD5 SHA1 SHA512
    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook Payload

    • Deletes itself

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks