General

  • Target
    ee7b6c6eb74583203bdd22c984601db627e7cda9c0e0d550a4b6483e4f52fb57
  • Size 1.1MB
  • Sample220524-ba6h6aeccl
  • SHA256 ee7b6c6eb74583203bdd22c984601db627e7cda9c0e0d550a4b6483e4f52fb57
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • formbook

Version
  • 3.9

Campaign
  • hx325

Decoy
  • chroniclesofthemind.com

  • roofingandsidingwork.com

  • arrqam.com

  • yadacraft.com

  • flexleague.online

  • lambdalille.com

  • angbaidou.com

  • beerfest.cool

  • paradiseeliteclub.com

  • wheresmylatte.com

  • marqueluxury.com

  • debtstoppersatl1.com

  • manekinekoorner.win

  • gorillatreksafarisafrica.com

  • lzqianbao.com

  • 232doner.com

  • taliciareneeministries.info

  • geziyasasi.com

  • firehousesmokies.com

  • veoceo.com

Targets

    • Target
      ee7b6c6eb74583203bdd22c984601db627e7cda9c0e0d550a4b6483e4f52fb57
    • Size 1.1MB
    • SHA256 ee7b6c6eb74583203bdd22c984601db627e7cda9c0e0d550a4b6483e4f52fb57
    • MD5 SHA1 SHA512
    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook Payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks