General

  • Target
    offer.exe
  • Size 495KB
  • Sample200813-dlk2k848mx
  • SHA256 70fce2b9eb9360b8733c9b77032bb566399d7ed9c2fb99b0cf2c823e93485bd9
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • formbook

C2
  • http://www.fex-tracks.com/xczm/

Decoy
  • graceandnathangetknotted.com

  • myporndesires.com

  • alphagamingaccessories.com

  • 51zhuimeng.com

  • 196wrf.info

  • lubanzizhi.com

  • 107xt.com

  • jatinangorcity.com

  • tumblrdatinggame.com

  • mtorc1inhibitor.com

  • boogxgenblm.live

  • iotaneuralnetwork.com

  • booksinclouds.co.uk

  • made-in-asiago.tech

  • myfunbooks.net

  • rglrgrl.net

  • azumiyakkyoku.info

  • qasryna.com

  • ara-digital.com

  • barnboost.com

Targets

    • Target
      offer.exe
    • Size 495KB
    • SHA256 70fce2b9eb9360b8733c9b77032bb566399d7ed9c2fb99b0cf2c823e93485bd9
    • MD5 SHA1 SHA512
    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook Payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks