General

  • Target
    triage_dropped_file
  • Size 699KB
  • Sample220804-r7kwqagae9
  • SHA256 afa4507bce58af7b4050b41a86eabf424ac0e89a69b8a962c1dd58a1620457b5
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • formbook

Version
  • 4.1

Campaign
  • gu5d

Decoy
  • blevvv.com

  • yoy01.com

  • balkhmarketing.agency

  • gangguanchina.net

  • 0f0t6l.space

  • trump-news.com

  • hymanpullan.online

  • westsernschools.com

  • yourturdburglars.com

  • exitplanning101.com

  • vetsflyfree.xyz

  • sedist.net

  • bestkinopoisk.com

  • maccaverns.com

  • 434960.com

  • mbyestudio.online

  • goldenagemininggroup.com

  • mintdomainz.xyz

  • www2823s.net

  • smartbeds-lt-2022.life

Targets

    • Target
      triage_dropped_file
    • Size 699KB
    • SHA256 afa4507bce58af7b4050b41a86eabf424ac0e89a69b8a962c1dd58a1620457b5
    • MD5 SHA1 SHA512
    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook payload

    • Deletes itself

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks