General

  • Target
    c35b8d27f7ed050e3bc31e536a0e389f
  • Size 822KB
  • Sample220218-nyfnvscea2
  • SHA256 c8dfddd4c5d6b2c5ee3c4f74651673e6975c4ae05d7aece0c08e40c2ad92db7e
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • formbook

Version
  • 4.1

Campaign
  • vy44

Decoy
  • csdvehgry45y.com

  • letstayhome.com

  • davidfrechen.com

  • atticusandjules.com

  • meandbond.com

  • paar-fotoshooting.com

  • twboosterhq.com

  • shivamehandiarts.com

  • typhoonlogistics.net

  • vintagevowswedding.com

  • brittanymays.com

  • dreamylineart.com

  • vimspaces.com

  • thakurmosai.com

  • 88-wealth.com

  • betsycousins.com

  • nationalcsno.online

  • mobileblockchainsolution.com

  • flymetothemundo.com

  • shopsuplementos.site

Targets

    • Target
      c35b8d27f7ed050e3bc31e536a0e389f
    • Size 822KB
    • SHA256 c8dfddd4c5d6b2c5ee3c4f74651673e6975c4ae05d7aece0c08e40c2ad92db7e
    • MD5 SHA1 SHA512
    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook Payload

    • Uses the VBS compiler for execution

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks