General

  • Target
    3BJGa7Xw4ugPpll.exe
  • Size 990KB
  • Sample201012-485rhgmfx6
  • SHA256 f397c24f2c684fdcd51dc9954c641d013437a78e24a5cf8c8778196a66a60372
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • formbook

C2
  • http://www.trusted-inspections.com/k8b/

Decoy
  • lulubellsgraphicsanddesigns.com

  • metyx.info

  • www423337.com

  • stayliveclothing.com

  • daluotech.com

  • thetruthpublished.com

  • pqlzlnwpz.icu

  • bilginhayvancilik.com

  • ismartdvr.com

  • currenibtc.com

  • dalesj.com

  • restaurantlemontblanc.com

  • lunarstores.com

  • pho-huy.com

  • liquidhardrive.com

  • bcheaplivebuy.com

  • evisaagency.com

  • houstonemergencycenter.com

  • alioverstreet.com

  • nutrhyp.com

Targets

    • Target
      3BJGa7Xw4ugPpll.exe
    • Size 990KB
    • SHA256 f397c24f2c684fdcd51dc9954c641d013437a78e24a5cf8c8778196a66a60372
    • MD5 SHA1 SHA512
    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook Payload

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks