General

  • Target
    3247f8db646f5e524df32ea6a29e33d9
  • Size 801KB
  • Sample220215-zyandsaca9
  • SHA256 921628eeb649a7c9f45ccb4b95ccecba8a76e273a88bdf8478c7e63cef2fb10a
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • formbook

Version
  • 4.1

Campaign
  • vy44

Decoy
  • csdvehgry45y.com

  • letstayhome.com

  • davidfrechen.com

  • atticusandjules.com

  • meandbond.com

  • paar-fotoshooting.com

  • twboosterhq.com

  • shivamehandiarts.com

  • typhoonlogistics.net

  • vintagevowswedding.com

  • brittanymays.com

  • dreamylineart.com

  • vimspaces.com

  • thakurmosai.com

  • 88-wealth.com

  • betsycousins.com

  • nationalcsno.online

  • mobileblockchainsolution.com

  • flymetothemundo.com

  • shopsuplementos.site

Targets

    • Target
      3247f8db646f5e524df32ea6a29e33d9
    • Size 801KB
    • SHA256 921628eeb649a7c9f45ccb4b95ccecba8a76e273a88bdf8478c7e63cef2fb10a
    • MD5 SHA1 SHA512
    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook Payload

    • Uses the VBS compiler for execution

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks