General

  • Target
    eed37078c2abd45504eebb66e9a99564.exe
  • Size 666KB
  • Sample201007-akvxdcv8qa
  • SHA256 fd9f113a78e94fc975ba4e5e940c91395e63b5ea904e7690fbad9f569b6da1b8
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • formbook

C2
  • http://www.ccminghao.com/bnc/

Decoy
  • iseoguide.com

  • rogerellisonline.com

  • thephonelenses.com

  • reddystone.com

  • explorehokianga.com

  • miaflcio.vote

  • baonihaochi.com

  • thewiseengineer.com

  • exciplexinc.com

  • luewaeeqaredre.com

  • atharvatechnologysolutions.com

  • vnsr1234.com

  • nationswines.com

  • toaglobalcc.com

  • texasbusrental.com

  • sailfishingcostarica.com

  • superbuy.today

  • mode-paradox.com

  • soperlz.xyz

  • filterdance.com

Targets

    • Target
      eed37078c2abd45504eebb66e9a99564.exe
    • Size 666KB
    • SHA256 fd9f113a78e94fc975ba4e5e940c91395e63b5ea904e7690fbad9f569b6da1b8
    • MD5 SHA1 SHA512
    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook Payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks