General

  • Target
    PO.21322.pdf.exe
  • Size 1013KB
  • Sample220321-xvx86sdeg4
  • SHA256 def9b0d4675814fa8872b848059fcc239915fe71bb363685d495ebf799c9bfc4
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • formbook

Version
  • 4.1

Campaign
  • a30t

Decoy
  • nietru.icu

  • saudiafc.com

  • 8120567.com

  • grundrow.site

  • tsinversiones.com

  • sytgzx.com

  • hannoschoeck.online

  • cerdacapital.com

  • mastercard-tz.com

  • asupermarkt.store

  • carmobility.online

  • estudiocontablegrados.com

  • downtis.online

  • kingdomdefensesystems.net

  • mw.sbs

  • aiotrip.com

  • decentralcase.com

  • intentionallivingwithmeb.com

  • administratorlope.site

  • uc-un.com

Targets

    • Target
      PO.21322.pdf.exe
    • Size 1013KB
    • SHA256 def9b0d4675814fa8872b848059fcc239915fe71bb363685d495ebf799c9bfc4
    • MD5 SHA1 SHA512
    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook Payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks