General

  • Target
    c0fed64dae580efb8fb8308accf76cac.exe
  • Size 477KB
  • Sample220113-tprmnabdgl
  • SHA256 5bd07db2eed6c7e67e3f3947b5336c6ba986cfbd03bd406c13eda1999a64fc70
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • formbook

Version
  • 4.1

Campaign
  • a83r

Decoy
  • comercializadoralonso.com

  • durhamschoolservces.com

  • onegreencapital.com

  • smartcities24.com

  • maquinas.store

  • brianlovesbonsai.com

  • xin41518s.com

  • moneyearnus.xyz

  • be-mix.com

  • fengyat.club

  • inspectdecided.xyz

  • paksafpakistan.com

  • orhidlnt.top

  • princesuraj.com

  • vietnamvodka.com

  • renewnow.site

  • imageservices.xyz

  • luxurytravelfranchise.com

  • kp112.red

  • royalyorkfirewood.com

Targets

    • Target
      c0fed64dae580efb8fb8308accf76cac.exe
    • Size 477KB
    • SHA256 5bd07db2eed6c7e67e3f3947b5336c6ba986cfbd03bd406c13eda1999a64fc70
    • MD5 SHA1 SHA512
    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook Payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks