General

  • Target
    NEW ORDER.scr
  • Size 818KB
  • Sample220129-lzhthaabf7
  • SHA256 f2d58fc68302fb9cfc6ba93ca4f01f17c8baf7fef4cdfef59638e61fa4f54ad4
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • formbook

Version
  • 4.1

Campaign
  • s16r

Decoy
  • kellieroysellsnc.com

  • valleylowvoltage.com

  • mltuo900.xyz

  • visitingpuntacana.com

  • weiwushi.com

  • austintechjob.com

  • rxstarcbd.com

  • shopstudioesi.com

  • filetto-server.xyz

  • relianceltdbnk.com

  • unethical.world

  • yedd.store

  • esthershhs.com

  • magaddis.com

  • scenicdrivetours.com

  • 123gest.com

  • 2020mortagelifeinsurance.com

  • faceinle.com

  • integritymarking.com

  • alfatoto.xyz

Targets

    • Target
      NEW ORDER.scr
    • Size 818KB
    • SHA256 f2d58fc68302fb9cfc6ba93ca4f01f17c8baf7fef4cdfef59638e61fa4f54ad4
    • MD5 SHA1 SHA512
    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook Payload

    • Deletes itself

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks