General

  • Target
    7572fbc5de30359e833d6f382db286fa.exe
  • Size 843KB
  • Sample210927-kd8blagbd9
  • SHA256 1758a9b18032ce82f4e95249413ee1a8cbade1ef2cb773bc958502801f3af738
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • formbook

Version
  • 4.1

Campaign
  • if60

C2
  • http://www.handelsbetriebposavec.com/if60/

Decoy
  • babyjames.space

  • dtjug.com

  • bhagteri.com

  • havplan.com

  • gentlesuccess.net

  • negativeminus.com

  • utesm.com

  • ngomen.online

  • abohemianeducation.com

  • hyper-quote.com

  • poseidonflooring.com

  • theshopdental.com

  • consumelocaloficial.com

  • tineue.com

  • traerpolio.com

  • somnambulantfarms.com

  • sugarhillclassiccars.com

  • brasseriedufayard.com

  • replacerglass.net

  • lazyguysmarketing.com

Targets

    • Target
      7572fbc5de30359e833d6f382db286fa.exe
    • Size 843KB
    • SHA256 1758a9b18032ce82f4e95249413ee1a8cbade1ef2cb773bc958502801f3af738
    • MD5 SHA1 SHA512
    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook Payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks