General

  • Target
    259804c409e6b0863afa760aa54e9004.exe
  • Size 811KB
  • Sample220209-ts4rdsbbaj
  • SHA256 76fb4deca980cbc985a590ac1f8481bc1b08cd9ab19fd24c902cc58347e792f6
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • formbook

Version
  • 4.1

Campaign
  • d7ln

Decoy
  • bulut-imza.com

  • gotastebuds.com

  • shutupmags.com

  • clocksport.com

  • toweryachtcounsel.com

  • kingcopier.com

  • pluspersona.com

  • inchallahe.com

  • unclonedconsulting.com

  • ccdt168.com

  • tonyzheng.xyz

  • voiceoftheepeople.com

  • cicapital.xyz

  • offxpro.com

  • loyatiproductions.com

  • makemebuystuff.com

  • incuba8labs.com

  • remparka.com

  • newstft.com

  • bgame.pro

Targets

    • Target
      259804c409e6b0863afa760aa54e9004.exe
    • Size 811KB
    • SHA256 76fb4deca980cbc985a590ac1f8481bc1b08cd9ab19fd24c902cc58347e792f6
    • MD5 SHA1 SHA512
    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook Payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks