General

  • Target
    rC-P-0000054697.exe
  • Size 53KB
  • Sample240212-nfzzsadf36
  • SHA256 9468b7cfa32f2686cc980eaa9b4b49dfbcd55c7f2cd5c7cbeec676ec7d848693
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • formbook

Version
  • 4.1

Campaign
  • ve92

Decoy
  • 1o8tvq.vip

  • pecosnew.com

  • airgunarrow.com

  • yh1584.com

  • mymonte.online

  • zalando6.top

  • 2tg7y.vip

  • jeffwertdesign.com

  • nayl7xd86.sbs

  • 7diw0qocyi.site

  • locknlockmall.shop

  • rsenv.cyou

  • bigwin123-18.com

  • dgorl3ayi.sbs

  • festateca.cat

  • brewtec.pro

  • dengi-russia.shop

  • 64517.vip

  • onefreechapter.com

  • 188100.space

Targets

    • Target
      rC-P-0000054697.exe
    • Size 53KB
    • SHA256 9468b7cfa32f2686cc980eaa9b4b49dfbcd55c7f2cd5c7cbeec676ec7d848693
    • MD5 SHA1 SHA512 SSDEEP
    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks