General

  • Target
    Re, cotizaci¢n.exe
  • Size 828KB
  • Sample220815-hqdlmsacf9
  • SHA256 37e6fcc2791cdc7fa2f5a433d7b13d0d57857cde8ab4aec7e5da2879eee8bb59
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • formbook

Version
  • 4.1

Campaign
  • ng04

Decoy
  • tevimaq.com

  • easterspecialtystore.com

  • smartlever.tech

  • 10312.uk

  • tanjawiharbi.co.uk

  • 471338.com

  • horusventure.com

  • empress-care.com

  • sinrian.com

  • 465951.com

  • aemsti.com

  • nxcourier.com

  • stargatefarms.com

  • lalyquainvestment.com

  • dailysportsadvice.com

  • justlistmoore.com

  • stoneonroll.online

  • tatianakolomiets.com

  • barcodebbm.com

  • protectorship.world

Targets

    • Target
      Re, cotizaci¢n.exe
    • Size 828KB
    • SHA256 37e6fcc2791cdc7fa2f5a433d7b13d0d57857cde8ab4aec7e5da2879eee8bb59
    • MD5 SHA1 SHA512
    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook payload

    • Deletes itself

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks