General

  • Target
    0mwSprBZ47mNQyY.exe
  • Size 665KB
  • Sample200812-9hpcdz8xle
  • SHA256 ea74eac48adf2b19c3102578cb14ee0cd1d51f5e5e1da2fb4ab5b0d3f7e91827
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • formbook

C2
  • http://www.regulars6.com/zaer/

Decoy
  • lipbombed.com

  • abmeadors-insurance.biz

  • devtechsolar.com

  • austin-roofingcontractor.com

  • makavelioffspring.com

  • sredalab.com

  • attractionvideo.com

  • designmouldingterrain.com

  • nicerecipes15.info

  • gdclosalcores.com

  • jesussaysyesorno.online

  • forpleasantsleep.com

  • cynthiascountrystore.com

  • thedisinsiderbeta.com

  • dushixue.com

  • eveitis.com

  • huyue-jixie.com

  • buoyantcoin.com

  • london-security-shutters.com

  • fokusworld.com

Targets

    • Target
      0mwSprBZ47mNQyY.exe
    • Size 665KB
    • SHA256 ea74eac48adf2b19c3102578cb14ee0cd1d51f5e5e1da2fb4ab5b0d3f7e91827
    • MD5 SHA1 SHA512
    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook Payload

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks