General

  • Target
    zWC6iOTJphZA0sb.exe
  • Size 781KB
  • Sample201013-48smmsygq2
  • SHA256 76e0bf03767dfd6316810d96d2404daf16397a0ef3b90daf96ad67bc461209a8
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • formbook

C2
  • http://www.trusted-inspections.com/k8b/

Decoy
  • lulubellsgraphicsanddesigns.com

  • metyx.info

  • www423337.com

  • stayliveclothing.com

  • daluotech.com

  • thetruthpublished.com

  • pqlzlnwpz.icu

  • bilginhayvancilik.com

  • ismartdvr.com

  • currenibtc.com

  • dalesj.com

  • restaurantlemontblanc.com

  • lunarstores.com

  • pho-huy.com

  • liquidhardrive.com

  • bcheaplivebuy.com

  • evisaagency.com

  • houstonemergencycenter.com

  • alioverstreet.com

  • nutrhyp.com

Targets

    • Target
      zWC6iOTJphZA0sb.exe
    • Size 781KB
    • SHA256 76e0bf03767dfd6316810d96d2404daf16397a0ef3b90daf96ad67bc461209a8
    • MD5 SHA1 SHA512
    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook Payload

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks