General

  • Target
    87869f39271a39790c4be28e50cf8ce5
  • Size 776KB
  • Sample220408-ll2pfsbfb7
  • SHA256 c0760105fed05b99698c3f1e5bb6ed6e2e9b386315d0e187cd075b8ed5ea7fe5
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • formbook

Version
  • 4.1

Campaign
  • ce20

Decoy
  • tiendacbdsevilla.com

  • cambodianairlines.net

  • xtypelife.online

  • 8568008.com

  • truelanguageacademy.com

  • fibverse.com

  • thhhh.xyz

  • maskschool.com

  • missbrazilsc.com

  • suonas.com

  • esteel24.com

  • dreamoffkartal.com

  • errebasics.com

  • novaworldmarinacity.com

  • sailingt.com

  • 8ylady.com

  • d5lb1.club

  • mexicovegetal.com

  • ahfsaleleaseback.com

  • sjcad11.com

Targets

    • Target
      87869f39271a39790c4be28e50cf8ce5
    • Size 776KB
    • SHA256 c0760105fed05b99698c3f1e5bb6ed6e2e9b386315d0e187cd075b8ed5ea7fe5
    • MD5 SHA1 SHA512
    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook Payload

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks