General

  • Target
    aa6168d4e41ced2091baee9f5d59e11e.exe
  • Size 228KB
  • Sample210503-pnjf2hswex
  • SHA256 7c6393b4e86ea5cec49c0f814b17e4bb85aa447c19896037252a94ff6416ce1b
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • formbook

Version
  • 4.1

C2
  • http://www.shoprodeovegas.com/xcl/

Decoy
  • sewingtherose.com

  • thesmartshareholder.com

  • afasyah.com

  • marolamusic.com

  • lookupgeorgina.com

  • plataforyou.com

  • dijcan.com

  • pawtyparcels.com

  • interprediction.com

  • fairerfinancehackathon.net

  • thehmnshop.com

  • jocelynlopez.com

  • launcheffecthouston.com

  • joyeveryminute.com

  • spyforu.com

  • ronerasanjuan.com

  • gadgetsdesi.com

  • nmrconsultants.com

  • travellpod.com

  • ballparksportscards.com

Targets

    • Target
      aa6168d4e41ced2091baee9f5d59e11e.exe
    • Size 228KB
    • SHA256 7c6393b4e86ea5cec49c0f814b17e4bb85aa447c19896037252a94ff6416ce1b
    • MD5 SHA1 SHA512
    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook Payload

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks