General

  • Target
    Product Inquiry - PFIZER 05.22.2023.exe
  • Size 685KB
  • Sample230522-kpv6eahh61
  • SHA256 6ea7ca3a65d2621c8a9c7502eb9a7f914d5a155a3791e551cc3308f638ea307c
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • formbook

Version
  • 4.1

Campaign
  • ca82

Decoy
  • joins-israel.com

  • suffolksheep.net

  • audiservisi.online

  • lomasleisuregas.co.uk

  • bbyuanzhi.com

  • asapmotohub.com

  • witneshambarleymow.co.uk

  • krmediaagency.com

  • alfonsoscuottosrl.net

  • cabsforrental.com

  • drx72.com

  • allegories-bunk.click

  • aladdinhouseofkabobgyros.com

  • glhbsy.com

  • mummytwinzsolutions.africa

  • bwin455.com

  • 7fea.site

  • czwjjgcbearing.com

  • giwamfbank.africa

  • iweb4logmt.com

Targets

    • Target
      Product Inquiry - PFIZER 05.22.2023.exe
    • Size 685KB
    • SHA256 6ea7ca3a65d2621c8a9c7502eb9a7f914d5a155a3791e551cc3308f638ea307c
    • MD5 SHA1 SHA512 SSDEEP
    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook payload

    • Deletes itself

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks