General

  • Target
    Purchase Order 40,7045.exe
  • Size 468KB
  • Sample201119-8y7nfacbte
  • SHA256 7ab132d4889dabc0385ba4dd9ca727ccbc241791f851da7ab1afb09858fe8634
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • formbook

C2
  • http://www.sweetbasilmarketing.com/igqu/

Decoy
  • coveloungewineandwhiskey.com

  • chemtradent.com

  • educare.cloud

  • shopnicknaks.com

  • realitytvstockwatch.com

  • handsfreedocs.com

  • trafegopago.com

  • ariasu-nakanokaikei.com

  • allmm.info

  • elleatx.com

  • erpsystem.site

  • whatisastaxanthin.com

  • hemparcade.com

  • ownumo.com

  • pasumaisangam.com

  • theoutdoorbed.com

  • plantpowered.energy

  • elevenelevenapparelcompany.com

  • vrspace.ltd

  • justsoldbykristen.com

Targets

    • Target
      Purchase Order 40,7045.exe
    • Size 468KB
    • SHA256 7ab132d4889dabc0385ba4dd9ca727ccbc241791f851da7ab1afb09858fe8634
    • MD5 SHA1 SHA512
    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook Payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks