General

  • Target
    YP20210925.exe
  • Size 441KB
  • Sample211019-kvg6qsfea2
  • SHA256 f358d592a02990a899bc4ca7c35804529237cbffac5dcabb3e7e3916a79afbb4
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • formbook

Version
  • 4.1

Campaign
  • cb2k

C2
  • http://www.freegovphoneservice.com/cb2k/

Decoy
  • prets-personnels-faciles-1.com

  • lavandica.com

  • 855goldenpark.com

  • ebrandschool.com

  • annielaineinspirations.com

  • tuscumbiadivorceattorney.com

  • lovarebanwgt74.xyz

  • car-plus.info

  • fireloops.net

  • psychtechsolutions.com

  • didubreak.com

  • cursodesigndesobrancelhas.com

  • berrymyrick.com

  • visit-croatia-now.com

  • chamonix-cars.club

  • 1679tnpnd01uzznpvfu8795.com

  • noisedelayrecovery.com

  • sergiotimoteo.com

  • lplc.cloud

  • ppezjo.com

Targets

    • Target
      YP20210925.exe
    • Size 441KB
    • SHA256 f358d592a02990a899bc4ca7c35804529237cbffac5dcabb3e7e3916a79afbb4
    • MD5 SHA1 SHA512
    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook Payload

    • Deletes itself

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks