General

  • Target
    96c7077889ab23b8df01bca77a45a4df
  • Size 715KB
  • Sample220412-s37elagcc5
  • SHA256 2dac503b9c06d06387e62a41fe9f9e179df1aba575a3b2aece6d508b7c2e0d4f
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • formbook

Version
  • 4.1

Campaign
  • g9s4

Decoy
  • visitmechanic.com

  • xn--kck4a7gpd474vx6i.com

  • prozdorovie.online

  • omatpupa.xyz

  • zamokwakhekhumalo.com

  • mayuraandchris.com

  • wanasahstore.com

  • bicicletas.win

  • yhdm61.com

  • mortgageattract.com

  • centuryofbio.com

  • xtdkgjt.com

  • nhahangnetnghe.com

  • whatsappsemcontato.com

  • onlinemarketing-teamwebus.com

  • zuevu.com

  • dancaronmusic.com

  • tingseo.com

  • uniflapline.com

  • setuppharmaweb.online

Targets

    • Target
      96c7077889ab23b8df01bca77a45a4df
    • Size 715KB
    • SHA256 2dac503b9c06d06387e62a41fe9f9e179df1aba575a3b2aece6d508b7c2e0d4f
    • MD5 SHA1 SHA512
    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook Payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks