General

  • Target
    Thanh Tuan Co., Ltd - Inquiry List & Sample Photos.pdf.exe
  • Size 51KB
  • Sample220321-vsj8eshfar
  • SHA256 909570efc48341a6ae00ae8dcbb8d751f912569a4756f7526bc7d0cf1cda81ed
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • formbook

Version
  • 4.1

Campaign
  • gaou

Decoy
  • kreditkleansers.com

  • energyandoils.com

  • 0wzr2dglc.com

  • coachadrisanchez.com

  • region10group.gmbh

  • shinraibuy.com

  • theleftycatcher.com

  • shop-hatchshowprint.xyz

  • mutoros.com

  • anicolon.com

  • tb19151.icu

  • vinyetgriera.online

  • hunterz-it.cloud

  • scareygood.com

  • newbalanceshopping.xyz

  • perfectgrsl.net

  • qffi.top

  • antoniocuomosindaco.com

  • evesbond.com

  • finelowdowntoskimtoday.info

Targets

    • Target
      Thanh Tuan Co., Ltd - Inquiry List & Sample Photos.pdf.exe
    • Size 51KB
    • SHA256 909570efc48341a6ae00ae8dcbb8d751f912569a4756f7526bc7d0cf1cda81ed
    • MD5 SHA1 SHA512
    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • suricata: ET MALWARE FormBook CnC Checkin (GET)

      suricata: ET MALWARE FormBook CnC Checkin (GET)

    • Formbook Payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks