General

  • Target
    p5QtI97P3kMxZO4.exe
  • Size 864KB
  • Sample201010-43x3fl32zn
  • SHA256 db53a27c43dddb419e9d058e6288f3c1e7fc7e4bd62e3bb048e7103dcf79d682
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • formbook

C2
  • http://www.trusted-inspections.com/k8b/

Decoy
  • lulubellsgraphicsanddesigns.com

  • metyx.info

  • www423337.com

  • stayliveclothing.com

  • daluotech.com

  • thetruthpublished.com

  • pqlzlnwpz.icu

  • bilginhayvancilik.com

  • ismartdvr.com

  • currenibtc.com

  • dalesj.com

  • restaurantlemontblanc.com

  • lunarstores.com

  • pho-huy.com

  • liquidhardrive.com

  • bcheaplivebuy.com

  • evisaagency.com

  • houstonemergencycenter.com

  • alioverstreet.com

  • nutrhyp.com

Targets

    • Target
      p5QtI97P3kMxZO4.exe
    • Size 864KB
    • SHA256 db53a27c43dddb419e9d058e6288f3c1e7fc7e4bd62e3bb048e7103dcf79d682
    • MD5 SHA1 SHA512
    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook Payload

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks