General

  • Target
    TS-240405-UF4.exe
  • Size 564KB
  • Sample240405-nql6nsbc55
  • SHA256 ff992922faba92aaae30e5f2b9e4179209fe9242a90da90fe082f50e93138fc7
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • formbook

Version
  • 4.1

Campaign
  • be03

Decoy
  • 458q14v4ams2.com

  • priceoctopus.com

  • betinplay.xyz

  • bcnd.xyz

  • 1510soliveavenue.com

  • mcdpropertypros.com

  • reddcrownexpress.com

  • rewardlabs.shop

  • burenbrand.com

  • revand.io

  • tractionendurancecoaching.com

  • jotaerreshopp.com

  • shopboyg.com

  • dakor.shop

  • groundswellmag.life

  • nehagadodia.com

  • dancarellibizbroker.com

  • meconline.co

  • ttmq.cc

  • thegoldenyouph.com

Targets

    • Target
      TS-240405-UF4.exe
    • Size 564KB
    • SHA256 ff992922faba92aaae30e5f2b9e4179209fe9242a90da90fe082f50e93138fc7
    • MD5 SHA1 SHA512 SSDEEP
    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook payload

    • Deletes itself

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks