General

  • Target
    g5f91.exe
  • Size 430KB
  • Sample201001-jdy7wp2bas
  • SHA256 0538ad6e3f92ea13a5a3dadb18e807ce26097bbfd2f473e873a514b6dbbe8f5d
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • formbook

C2
  • http://www.elevatedqueensnc.com/ajr/

Decoy
  • cokefork.com

  • sunsabe.com

  • tactical-milsim.com

  • johnporcaro.com

  • quantqubit.com

  • ehrbar2012.com

  • dailymoringpages.com

  • masteronlineteams.com

  • signocomunicaciones.com

  • entrepreneur-de-demain.com

  • eve-echoes-data.com

  • readingbythewindow.com

  • quoteshark.net

  • mundoeconomic.com

  • bootlegmask.com

  • sporkedmissoula.com

  • claricitywealthplanning.net

  • lyotrade.net

  • brandtokitchens.com

  • blackstorymedia.com

Targets

    • Target
      g5f91.exe
    • Size 430KB
    • SHA256 0538ad6e3f92ea13a5a3dadb18e807ce26097bbfd2f473e873a514b6dbbe8f5d
    • MD5 SHA1 SHA512
    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook Payload

    • Deletes itself

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks