General

  • Target
    confirm this order and sign PI.gz
  • Size 715KB
  • Sample210426-ct59vpvb4x
  • SHA256 bc429aca6dcf6a9b2315f7cdf4465ceb8a4f5ded220c7c6ef2c6781d5d5dafc4
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • formbook

Version
  • 4.1

C2
  • http://www.magnumopuspro.com/nyr/

Decoy
  • anemone-vintage.com

  • ironcitytools.com

  • joshandmatthew.com

  • breathtakingscenery.photos

  • karabakh-terror.com

  • micahelgall.com

  • entretiendesterrasses.com

  • mhgholdings.com

  • blewm.com

  • sidewalknotary.com

  • ytrs-elec.com

  • danhpham.com

  • ma21cle2henz.xyz

  • lotusforlease.com

  • shipleyphotoandfilm.com

  • bulktool.xyz

  • ouedzmala.com

  • yichengvpr.com

  • connectmygames.com

  • chjcsc.com

Targets

    • Target
      confirm this order and sign PI.exe
    • Size 1.1MB
    • SHA256 f6b1a22c0cfc0c363bb163b7bd3236ee1dac2995a3511a6a941b7a7af656ba25
    • MD5 SHA1 SHA512
    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook Payload

    • Deletes itself

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks