General

  • Target
    4aa1142a3f569b23158f637ffb90d9ee
  • Size 242KB
  • Sample220321-p8n9escdb2
  • SHA256 df9fe11c039698ca36c7d81bd75de8700aacb67e4ce98b9df0ceaa2fe6d2c623
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • formbook

Version
  • 4.1

Campaign
  • sh30

Decoy
  • raptorwin.com

  • mmwavesolved.com

  • coachingwithcc.com

  • ssvminc.com

  • celdegobierno.info

  • wpaci.com

  • denison.top

  • fdsff.com

  • kelsapur.com

  • pontodeacucar.com

  • tgbamg.com

  • hkserver.xyz

  • muscatrfc.com

  • gylslgzn.com

  • roses-rouges.com

  • stanleymediaproductions.com

  • mintplatform.store

  • mentalallyhealth.com

  • lezfilm.com

  • lucarbo.com

Targets

    • Target
      4aa1142a3f569b23158f637ffb90d9ee
    • Size 242KB
    • SHA256 df9fe11c039698ca36c7d81bd75de8700aacb67e4ce98b9df0ceaa2fe6d2c623
    • MD5 SHA1 SHA512
    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook Payload

    • Executes dropped EXE

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks