General

  • Target
    PI6354.exe
  • Size 562KB
  • Sample200818-3ap8gt7ecn
  • SHA256 9ddbf1453097473cfa4eb4c1a28a6f4a2ecdac3b24179e6fd88d3444bf96ec23
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • formbook

C2
  • http://www.lonxer.com/hgn/

Decoy
  • chaskalocalseo.com

  • grandmaxwell.win

  • aspire-perspire.win

  • jeromesamuel.com

  • kcaslaboratories.info

  • 56ms.net

  • earth-workz.com

  • theproperdogpv.info

  • six4win.net

  • moda.photography

  • unelma.ventures

  • sarahjrbelanger.com

  • harryloveii.com

  • nationalgeo.online

  • webuycarsalgarve.com

  • xvitaxd.com

  • foodrollers.com

  • 7leju.com

  • shopbeautify.net

  • hyundaihochiminh.com

Targets

    • Target
      PI6354.exe
    • Size 562KB
    • SHA256 9ddbf1453097473cfa4eb4c1a28a6f4a2ecdac3b24179e6fd88d3444bf96ec23
    • MD5 SHA1 SHA512
    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook Payload

    • Deletes itself

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks