General

  • Target
    obizx.exe
  • Size 542KB
  • Sample220422-q2dd1scfe3
  • SHA256 8936c1cd18e085f39f8cb1c4ebacd04573a291e555d420acfb4845320e401aae
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • formbook

Version
  • 4.1

Campaign
  • o20a

Decoy
  • getplanda.com

  • wilmarrysteph.com

  • brandology.xyz

  • aseguranzas.online

  • ger.xyz

  • alibikoln.xyz

  • jmaisr.com

  • npydxwj.com

  • slotofun.net

  • marmpnthill.com

  • buildbostonbetter.com

  • tonealconsulting.com

  • hoteldhanashree.com

  • alignmentanalogue.site

  • arbasaa.xyz

  • jkesguerra.com

  • nrl4957.xyz

  • origine-workshop.com

  • ridstu.com

  • itaoshumiao.com

Targets

    • Target
      obizx.exe
    • Size 542KB
    • SHA256 8936c1cd18e085f39f8cb1c4ebacd04573a291e555d420acfb4845320e401aae
    • MD5 SHA1 SHA512
    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook Payload

    • Deletes itself

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks