General

  • Target
    Payment Details pdf.exe
  • Size 1.1MB
  • Sample220812-x53awaghgp
  • SHA256 9db7ece2184b1d22f94206fd18d539e2da6bb438e02af04794a3fcb0b483d7df
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • formbook

Version
  • 4.1

Campaign
  • o85a

Decoy
  • lvmh.store

  • grantrec.online

  • pinkglam.net

  • springreno.com

  • moneynappress.com

  • disclegends.net

  • taizonee9.app

  • 3365826.com

  • asdmohs19.website

  • atlantapolicy.com

  • rioinvestmentrd.com

  • alltriciashomemadegoodies.com

  • duanvidentcenter.com

  • whitelabelcasino.xyz

  • uptick.business

  • kickverseblade.store

  • malmotairi.com

  • nazhan.site

  • nehimiah.world

  • aero-bell.com

Targets

    • Target
      Payment Details pdf.exe
    • Size 1.1MB
    • SHA256 9db7ece2184b1d22f94206fd18d539e2da6bb438e02af04794a3fcb0b483d7df
    • MD5 SHA1 SHA512
    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks