General

  • Target
    payment delay.exe
  • Size 756KB
  • Sample201110-spff7ecjf2
  • SHA256 598bcdbe4c3e21a17a48d44dc03640f90643d1a03549ec429c7f96fd48e6a7ea
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • formbook

C2
  • http://www.bestancasterrealestateagent.com/shwq/

Decoy
  • yrataglance.com

  • lowcarbindulgence.com

  • xiangoshi.com

  • dev-dale.com

  • denichon.com

  • sewinplace.com

  • blandiskodk.com

  • iphonejailbreakplus.com

  • ramkihome.com

  • weargoodsport.com

  • fnafrica.com

  • yusuferdogan.com

  • chuqiong.com

  • cxmasmobitvmall.com

  • autosystems-mali.com

  • lacevortex.com

  • finessebygrace.com

  • gmz.one

  • catiemarvin.com

  • icesmooth.com

Targets

    • Target
      payment delay.exe
    • Size 756KB
    • SHA256 598bcdbe4c3e21a17a48d44dc03640f90643d1a03549ec429c7f96fd48e6a7ea
    • MD5 SHA1 SHA512
    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook Payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks