General

  • Target
    Purchase List .exe
  • Size 79KB
  • Sample240619-16w22aydqm
  • SHA256 6f61a8c2f7e89c87050811f34877179ed753ea5344115e7b059da05c3f1f2b79
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • formbook

Version
  • 4.1

Campaign
  • 45er

Decoy
  • depotpulsa.com

  • k2bilbao.online

  • bb4uoficial.com

  • rwc666.club

  • us-pservice.cyou

  • tricegottreats.com

  • zsystems.pro

  • qudouyin6.com

  • sfumaturedamore.net

  • pcetyy.icu

  • notbokin.online

  • beqprod.tech

  • flipbuilding.com

  • errormitigationzoo.com

  • zj5u603.xyz

  • jezzatravel.com

  • zmdniavysyi.shop

  • quinnsteele.com

  • 522334.com

  • outdoorshopping.net

Targets

    • Target
      Purchase List .exe
    • Size 79KB
    • SHA256 6f61a8c2f7e89c87050811f34877179ed753ea5344115e7b059da05c3f1f2b79
    • MD5 SHA1 SHA512 SSDEEP
    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook payload

    • Deletes itself

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks