General

  • Target
    INQUIRY SUBMITTAL_ADM SWITZERLAND.exe
  • Size 542KB
  • Sample211110-wza4rsaaa5
  • SHA256 fcaa502268e22400e98ae6f0842b7cf3598cf5a920c09a0d74996bdb64add249
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • formbook

Version
  • 4.1

Campaign
  • g8ni

C2
  • http://www.er5544.com/g8ni/

Decoy
  • nickmowat.com

  • garethjame.biz

  • colibrilift.com

  • vulnerabilitylabs.one

  • neuro-ai-web-ru.website

  • 16mcnaestreetmooneeponds.com

  • bestofstmaarten.net

  • meditelier.com

  • ragnarduke.com

  • escueladecampo.com

  • vongtayvn.com

  • inmemoriamaan.com

  • yourpeoplemanager.com

  • r6-gytr.com

  • agreeablebeauty.com

  • snpconfirms.com

  • tribalurq.quest

  • purafuse.com

  • cisco-training-course.com

  • wery.top

Targets

    • Target
      INQUIRY SUBMITTAL_ADM SWITZERLAND.exe
    • Size 542KB
    • SHA256 fcaa502268e22400e98ae6f0842b7cf3598cf5a920c09a0d74996bdb64add249
    • MD5 SHA1 SHA512
    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook Payload

    • Deletes itself

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks