General

  • Target
    javF11vuLhF2SXl.exe
  • Size 476KB
  • Sample201027-zlmtppdg26
  • SHA256 2736eab1d4bbb2dd220e5e34b8ea16a2495f6607d29f13d6314c07efc6cf757e
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • formbook

C2
  • http://www.bfboke.com/cpi/

Decoy
  • tw2dl.com

  • cdmingjun.com

  • tamquin.net

  • shipu252.com

  • teamxnd02.com

  • finansi.website

  • datainnbooking.com

  • shannonballcoach.com

  • giaoruou.club

  • tierraycielo.com

  • quizfall.info

  • hallwayworker.guru

  • smartfundoptions.com

  • iishon11.com

  • zzg-wj7k9.net

  • mylinkbio.com

  • xn--kzw5tq0of14b.com

  • coursereel.club

  • koalainsulationinc.com

  • 5ljhyr.com

Targets

    • Target
      javF11vuLhF2SXl.exe
    • Size 476KB
    • SHA256 2736eab1d4bbb2dd220e5e34b8ea16a2495f6607d29f13d6314c07efc6cf757e
    • MD5 SHA1 SHA512
    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook Payload

    • Deletes itself

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks