General

  • Target
    Reliable Supplies.exe
  • Size 548KB
  • Sample220331-apf2dabef5
  • SHA256 dcc2581e7d573e4a33a8e8edfe740f7b74c54fdfe12531ef1c5a8e13abd89e87
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • formbook

Version
  • 4.1

Campaign
  • d1n3

Decoy
  • scrubbinsisters.com

  • kawuldim.com

  • pyttoin.xyz

  • iyraproperties.com

  • miaurora.net

  • cricutonlinesales.store

  • huangsanguai.com

  • chayaelements.store

  • giftexpress15.xyz

  • antiwardrobe.com

  • wiggly.site

  • avrecommendwiki.com

  • galabet472.com

  • invtips.com

  • tvpoy.xyz

  • raidencity.net

  • ripper66.com

  • ipoyce.online

  • xn--h6q362bj4mp5c.com

  • rooplaza.com

Targets

    • Target
      Reliable Supplies.exe
    • Size 548KB
    • SHA256 dcc2581e7d573e4a33a8e8edfe740f7b74c54fdfe12531ef1c5a8e13abd89e87
    • MD5 SHA1 SHA512
    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook Payload

    • Blocklisted process makes network request

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks