General

  • Target
    5IYB3BCNQjj7wzj.exe
  • Size 530KB
  • Sample200817-9c8k9g7qde
  • SHA256 30d3cf43f91eea8df889ee14337ca8067bc68521ff63184c679aac80b321bb75
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • formbook

C2
  • http://www.regulars6.com/w5fk/

Decoy
  • wphi.net

  • variable-annuities.net

  • jp-payment-restriction.com

  • xcashmere.com

  • matematikmarketi.com

  • searchandresearch.ltd

  • strategyformat.com

  • redirecttacorp.com

  • smile-factory-misato.com

  • nrwlr.info

  • quboti.com

  • miraeevent.com

  • proroofclean.com

  • xmymzp.com

  • abettertoupgrade.win

  • sixstarscleaning.com

  • miyoqf.info

  • lightingiot.net

  • onlinesanalkart.biz

  • tapdndheros.com

Targets

    • Target
      5IYB3BCNQjj7wzj.exe
    • Size 530KB
    • SHA256 30d3cf43f91eea8df889ee14337ca8067bc68521ff63184c679aac80b321bb75
    • MD5 SHA1 SHA512
    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook Payload

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks