General

  • Target
    8be15b19f6f202c38dae3f5145363c69.exe
  • Size 406KB
  • Sample220118-w6m2xacdg3
  • SHA256 22633ca2e23a6d2353a4a2a4f87b02548fc9c9e92b4e482df9bae8e93c17b793
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • formbook

Version
  • 4.1

Campaign
  • ot22

Decoy
  • promotionalproduct.store

  • gaptoy.link

  • xu8dnowf9f91.xyz

  • shenzhendiamondleague.com

  • wwwmichaela.com

  • coachssales.com

  • chartertrustghana.com

  • ginawolfphotography.com

  • 6bz7ky.com

  • z8hzsmvmb1.xyz

  • gwans.net

  • wrpjeklw.website

  • odyssians.global

  • serviceacsidoarjomalang.com

  • hearinghealthcart.com

  • moderneheldinnen.com

  • venuebgcapartner.com

  • cxfun.net

  • cheanarwalin.xyz

  • freakytracks.com

Targets

    • Target
      8be15b19f6f202c38dae3f5145363c69.exe
    • Size 406KB
    • SHA256 22633ca2e23a6d2353a4a2a4f87b02548fc9c9e92b4e482df9bae8e93c17b793
    • MD5 SHA1 SHA512
    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook Payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks