General

  • Target
    PO2364#FD212003.exe
  • Size 1.0MB
  • Sample210118-v7433vs7d6
  • SHA256 f03367cb1758bddd8877e7aca02223797330fc8482d6ffce6f397730ffefd53f
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • formbook

C2
  • http://www.styrelseforum.com/p95n/

Decoy
  • kimberlyrutledge.com

  • auctus.agency

  • johnemotions.com

  • guilt-brilliant.com

  • wxshangdian.com

  • theolivetreeonline.com

  • stellarfranchisebrands.com

  • every1no1.com

  • hoangthanhgroup.com

  • psm-gen.com

  • kingdomwow.com

  • digitalksr.com

  • karynpolitoforlg.com

  • youthdaycalgary.com

  • libertyhandymanservicesllc.com

  • breatheohio.com

  • allenleather.com

  • transformafter50.info

  • hnhsylsb.com

  • hmtradebd.com

Targets

    • Target
      PO2364#FD212003.exe
    • Size 1.0MB
    • SHA256 f03367cb1758bddd8877e7aca02223797330fc8482d6ffce6f397730ffefd53f
    • MD5 SHA1 SHA512
    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook Payload

    • Deletes itself

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks