General

  • Target
    New Purchas Order.exe
  • Size 563KB
  • Sample220407-tvsrxaaeb7
  • SHA256 05a096d0b32ba6a4ef81bdf3794aaaffbae69c71c7bbe9506db9ebe30e168e4e
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • formbook

Version
  • 4.1

Campaign
  • d1n3

Decoy
  • scrubbinsisters.com

  • kawuldim.com

  • pyttoin.xyz

  • iyraproperties.com

  • miaurora.net

  • cricutonlinesales.store

  • huangsanguai.com

  • chayaelements.store

  • giftexpress15.xyz

  • antiwardrobe.com

  • wiggly.site

  • avrecommendwiki.com

  • galabet472.com

  • invtips.com

  • tvpoy.xyz

  • raidencity.net

  • ripper66.com

  • ipoyce.online

  • xn--h6q362bj4mp5c.com

  • rooplaza.com

Targets

    • Target
      New Purchas Order.exe
    • Size 563KB
    • SHA256 05a096d0b32ba6a4ef81bdf3794aaaffbae69c71c7bbe9506db9ebe30e168e4e
    • MD5 SHA1 SHA512
    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook Payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks