General

  • Target
    6223b5805cc8ceb0fad786c4bd2f176b.exe
  • Size 406KB
  • Sample220112-m3efxsccg7
  • SHA256 c3e318eafb968f401d5165bb17e765613339ce25e4e48e99ea734580fae06d84
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • formbook

Version
  • 4.1

Campaign
  • bt33

Decoy
  • mbaonlinefreedegress.info

  • myforevermaid.com

  • daoyi365.com

  • weientm.com

  • legal-mx.com

  • formationrigging.com

  • heidiet.xyz

  • school-prosto.store

  • healthvitaminnutrition.com

  • digitalsolutionusa.com

  • little-bazar.com

  • jnbeautycanada.com

  • optoelek.com

  • learntoairmail.com

  • hawkminer.com

  • kingofearth.love

  • ktnstay.xyz

  • zouxin.love

  • mainlandpr.com

  • mamm-hummel.com

Targets

    • Target
      6223b5805cc8ceb0fad786c4bd2f176b.exe
    • Size 406KB
    • SHA256 c3e318eafb968f401d5165bb17e765613339ce25e4e48e99ea734580fae06d84
    • MD5 SHA1 SHA512
    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook Payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks