General

  • Target
    c865606a4a120e31e30ef208ac4e66fc.exe
  • Size 587KB
  • Sample201006-a4chwp5jd6
  • SHA256 de4679b52c5e51db87ae9671ec2b25364dd62641377bfbfd6d5cf67e7741598c
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • formbook

C2
  • http://www.ccminghao.com/bnc/

Decoy
  • iseoguide.com

  • rogerellisonline.com

  • thephonelenses.com

  • reddystone.com

  • explorehokianga.com

  • miaflcio.vote

  • baonihaochi.com

  • thewiseengineer.com

  • exciplexinc.com

  • luewaeeqaredre.com

  • atharvatechnologysolutions.com

  • vnsr1234.com

  • nationswines.com

  • toaglobalcc.com

  • texasbusrental.com

  • sailfishingcostarica.com

  • superbuy.today

  • mode-paradox.com

  • soperlz.xyz

  • filterdance.com

Targets

    • Target
      c865606a4a120e31e30ef208ac4e66fc.exe
    • Size 587KB
    • SHA256 de4679b52c5e51db87ae9671ec2b25364dd62641377bfbfd6d5cf67e7741598c
    • MD5 SHA1 SHA512
    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook Payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks