General

  • Target
    1725d011fe582111bffaff69088b5914.exe
  • Size 903KB
  • Sample220412-pzl3psbdgj
  • SHA256 8523b78ec725e01d19eebfcc0ddd20f717ff3780f199116814628cf6078c3672
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • formbook

Version
  • 4.1

Campaign
  • g02e

Decoy
  • rankwrestles.com

  • dm285.com

  • 0824e.com

  • smaduread.com

  • staygoodbossedup.com

  • actacricket.xyz

  • djpauloso.com

  • collingwoodwellbabyclinic.com

  • fazzamedia.com

  • faento.online

  • devoteddixons.com

  • ljconcierto.com

  • dallasmorningpost.com

  • changledi.com

  • sz-lyfw.com

  • askdigiguru.com

  • aihongyan.com

  • educanet12.com

  • accedabancsabadell.com

  • vetkoekworld.com

Targets

    • Target
      1725d011fe582111bffaff69088b5914.exe
    • Size 903KB
    • SHA256 8523b78ec725e01d19eebfcc0ddd20f717ff3780f199116814628cf6078c3672
    • MD5 SHA1 SHA512
    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook Payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks