General

  • Target
    9dbc516af20f71e02a4a9d1c7bc6acdaeaccc37258a4ebeecaa9e670f05c13e7
  • Size 544KB
  • Sample220205-pgtd3abdhr
  • SHA256 9dbc516af20f71e02a4a9d1c7bc6acdaeaccc37258a4ebeecaa9e670f05c13e7
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • formbook

Version
  • 3.9

Campaign
  • dw5

Decoy
  • rincondeguyabitos.com

  • huawei.services

  • atria-securities.com

  • illect-mail.com

  • cerberus.digital

  • benefitsnursingvip.win

  • jimmywilliamsmusic1990.com

  • peabodyathleticclub.com

  • supporetuythub.online

  • supportf.net

  • arthurlazaryan.com

  • royalsparkfacility.com

  • wgshd.com

  • hzb-design.net

  • games-max.com

  • heatfreecurls.com

  • cryptocoinax.com

  • exoawk.com

  • gabbyoz.com

  • andibearing.com

Targets

    • Target
      9dbc516af20f71e02a4a9d1c7bc6acdaeaccc37258a4ebeecaa9e670f05c13e7
    • Size 544KB
    • SHA256 9dbc516af20f71e02a4a9d1c7bc6acdaeaccc37258a4ebeecaa9e670f05c13e7
    • MD5 SHA1 SHA512
    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook Payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks