General

  • Target
    c197813d47a7c48fc55e42b46d7de621.exe
  • Size 682KB
  • Sample220201-ve5bfaaaf4
  • SHA256 96de11fc0f948fc3039f297475ba8abfcedaa7a9718634359286fe49156cd216
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • formbook

Version
  • 4.1

Campaign
  • qugo

Decoy
  • sathapornstainlesssteel.com

  • everythingisaninvestment.com

  • appsbyraf.com

  • superhornygirl.club

  • christmastreeclass.com

  • cheatdayztogo.com

  • aadent7.com

  • divinitypath.com

  • figuli563.com

  • distanzalojistik.com

  • pricelesslookyto-looktoday.info

  • pcaaems.com

  • itsnewmovie.com

  • 4kx.claims

  • rental-aruyo.com

  • psiek.com

  • justnobleempress.com

  • 40daysfor40nights.com

  • 91266w.com

  • csi-texas.biz

Targets

    • Target
      c197813d47a7c48fc55e42b46d7de621.exe
    • Size 682KB
    • SHA256 96de11fc0f948fc3039f297475ba8abfcedaa7a9718634359286fe49156cd216
    • MD5 SHA1 SHA512
    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook Payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks