General

  • Target
    200f07a68b2fb323fa7f8cfa944a5bed193adfedcc00570a238fd66662109bd2
  • Size 1.6MB
  • Sample201112-ce5cgfstbn
  • SHA256 200f07a68b2fb323fa7f8cfa944a5bed193adfedcc00570a238fd66662109bd2
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • formbook

C2
  • http://www.outtheframecustoms.com/9t6k/

Decoy
  • parklineemployerperks.com

  • container-hq.com

  • harzproductions.com

  • wweebtedge.com

  • sandiegosalesandleasing.com

  • ri-web-dev.com

  • ufomars.com

  • countrybarndogkennel.com

  • imakestuff.xyz

  • lnmqjy.com

  • martialarttemple.com

  • jermaine-williams.com

  • ahomedokita.com

  • buttsliders.com

  • 3344cq.com

  • umkxmhopi.icu

  • houstonlasertreatment.com

  • makingdoathome.com

  • ladysativamarketing.com

  • shroomgiant.com

Targets

    • Target
      200f07a68b2fb323fa7f8cfa944a5bed193adfedcc00570a238fd66662109bd2
    • Size 1.6MB
    • SHA256 200f07a68b2fb323fa7f8cfa944a5bed193adfedcc00570a238fd66662109bd2
    • MD5 SHA1 SHA512
    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook Payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks