General

  • Target
    dee44580791ad105a240b06fab1bb1a5.exe
  • Size 412KB
  • Sample220112-m3z3macch5
  • SHA256 243bf6298e6d09d6b1defc371150fa5e0b34942eb6f2d616c187fa3fd7f44fbb
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • formbook

Version
  • 4.1

Campaign
  • bt33

Decoy
  • mbaonlinefreedegress.info

  • myforevermaid.com

  • daoyi365.com

  • weientm.com

  • legal-mx.com

  • formationrigging.com

  • heidiet.xyz

  • school-prosto.store

  • healthvitaminnutrition.com

  • digitalsolutionusa.com

  • little-bazar.com

  • jnbeautycanada.com

  • optoelek.com

  • learntoairmail.com

  • hawkminer.com

  • kingofearth.love

  • ktnstay.xyz

  • zouxin.love

  • mainlandpr.com

  • mamm-hummel.com

Targets

    • Target
      dee44580791ad105a240b06fab1bb1a5.exe
    • Size 412KB
    • SHA256 243bf6298e6d09d6b1defc371150fa5e0b34942eb6f2d616c187fa3fd7f44fbb
    • MD5 SHA1 SHA512
    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook Payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks