General

  • Target
    Purchase Order (#11022020]pdf.exe
  • Size 324KB
  • Sample220413-rgn6fscdf6
  • SHA256 ae2b607c9b6ba263d98e7bf7e0ed87287c33304752cf492dfff6f253f3e43289
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • formbook

Version
  • 4.1

Campaign
  • o27j

Decoy
  • catchakiller.net

  • nansatsu-meguri.com

  • torshowroom.com

  • loglog.company

  • diabetvn.online

  • pernie.digital

  • shopblodie.com

  • suzettedavidrealtor.com

  • 892uc.com

  • behlfamily.com

  • crazeekandee.com

  • internationalestimatings.com

  • afifurnishing.com

  • bjsalt2fen.com

  • tamdietitian.com

  • lo-nen.com

  • nanjinghu.com

  • dcato.xyz

  • right-on-target-store.com

  • xn--399a9jk03ai6p.com

Targets

    • Target
      Purchase Order (#11022020]pdf.exe
    • Size 324KB
    • SHA256 ae2b607c9b6ba263d98e7bf7e0ed87287c33304752cf492dfff6f253f3e43289
    • MD5 SHA1 SHA512
    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook Payload

    • Executes dropped EXE

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks