General

  • Target
    c067011c5c9dc7d9205b7a69e2c92633.exe
  • Size 437KB
  • Sample200904-v86lxvs7nj
  • SHA256 99ae2d3c813970e279188fa1fce92e70ac2ba63c03d2d04fd6f719d4953169c3
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • formbook

C2
  • http://www.porcber.com/jjk/

Decoy
  • xn--4oq39cm25azjf.com

  • 0150666.com

  • ciblgsaszwindjammer.review

  • sanantoniopromdresses.com

  • 500youxi.com

  • sccinvestmentnet.com

  • gadget13.com

  • femalebagvip.online

  • 100shadesofgreynoise.net

  • runningnewsbd.com

  • trumpteens.com

  • shopforfun.site

  • doggiesforlife.com

  • robotdollgo.win

  • xyxwg.com

  • fotomataio.com

  • goabm.info

  • catalyseur-de-vivant.com

  • ul-service.com

  • fl-exlink.top

Targets

    • Target
      c067011c5c9dc7d9205b7a69e2c92633.exe
    • Size 437KB
    • SHA256 99ae2d3c813970e279188fa1fce92e70ac2ba63c03d2d04fd6f719d4953169c3
    • MD5 SHA1 SHA512
    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook Payload

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks