General

  • Target
    233022d87ece4ece4348ab1c20644c3f.exe
  • Size 639KB
  • Sample220404-w67rbaeddp
  • SHA256 d727b63c6bcf81ea3c6a345f8435ad103f37c11c1b2cc89f9fee1f7253a26f9f
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • formbook

Version
  • 4.1

Campaign
  • g02e

Decoy
  • rankwrestles.com

  • dm285.com

  • 0824e.com

  • smaduread.com

  • staygoodbossedup.com

  • actacricket.xyz

  • djpauloso.com

  • collingwoodwellbabyclinic.com

  • fazzamedia.com

  • faento.online

  • devoteddixons.com

  • ljconcierto.com

  • dallasmorningpost.com

  • changledi.com

  • sz-lyfw.com

  • askdigiguru.com

  • aihongyan.com

  • educanet12.com

  • accedabancsabadell.com

  • vetkoekworld.com

Targets

    • Target
      233022d87ece4ece4348ab1c20644c3f.exe
    • Size 639KB
    • SHA256 d727b63c6bcf81ea3c6a345f8435ad103f37c11c1b2cc89f9fee1f7253a26f9f
    • MD5 SHA1 SHA512
    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook Payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks