General

  • Target
    Purchase Enquiry.exe
  • Size 527KB
  • Sample210211-n7vbvpayhs
  • SHA256 8a2020b3037513acb7c1bf54ba37376e3e8d04a047b97a2b035c12125e6c3ff3
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • formbook

C2
  • http://www.triumphantlytransformedbk.com/pep/

Decoy
  • whitelabelgraphics.pro

  • futureguidefilms.com

  • mission-duplex.com

  • rutherealty.com

  • acehardwaremall.com

  • potenb.com

  • tbhawt.com

  • momentum-ip.group

  • m8sr8s.com

  • cfwagner.com

  • umiyama-eri.com

  • klantenvinden.com

  • simplycasd.com

  • visionhomerecruiting.com

  • inkjet-material.com

  • banking-aib.com

  • fast1performance.com

  • eventsbyja.com

  • breuer.network

  • smartecelectronics.com

Targets

    • Target
      Purchase Enquiry.exe
    • Size 527KB
    • SHA256 8a2020b3037513acb7c1bf54ba37376e3e8d04a047b97a2b035c12125e6c3ff3
    • MD5 SHA1 SHA512
    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook Payload

    • Deletes itself

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks