General

  • Target
    6b739e1d35c38dd6b26a2c17d453746e.exe
  • Size 627KB
  • Sample220609-khly6aheb8
  • SHA256 bef4d2b112f31aa4e400f8a578eb87817ea1acda68d219f7c5d4387ceaf432cf
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • formbook

Version
  • 4.1

Campaign
  • e63z

Decoy
  • solariefy.com

  • zw323.top

  • somei8.com

  • rukbrook.com

  • iu5w.icu

  • escrow-hk.com

  • onlinereviewmonitor.com

  • maxxaktiv.com

  • directecole.com

  • walkinmovies.com

  • zxxiangr.com

  • prvmagapromo.com

  • mozogaotaxi.com

  • paralegaltraining.life

  • hayatkulturvakifi.com

  • beltmnn.com

  • olqlovea.com

  • theupsstore881.com

  • galmfrenchbulldogsny.com

  • stphilcc.com

Targets

    • Target
      6b739e1d35c38dd6b26a2c17d453746e.exe
    • Size 627KB
    • SHA256 bef4d2b112f31aa4e400f8a578eb87817ea1acda68d219f7c5d4387ceaf432cf
    • MD5 SHA1 SHA512
    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook Payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks