General

  • Target
    file.xe
  • Size 751KB
  • Sample201015-7rwaq3vr2s
  • SHA256 0c3afc73b1560d5d817104a616325e9f7a825e6b0158dfa0469b423c8bfbdf64
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • formbook

C2
  • http://www.mxmsportsgear.com/dfr/

Decoy
  • sizcabs.com

  • neochempharma.com

  • femuewedrewa.com

  • sedeot.com

  • dstresscafe.com

  • anthemation.com

  • starcmantova.com

  • brainstore1.com

  • karishara.com

  • amelclothing.com

  • shopmarielcosmetics.com

  • shreejeematrimonial.com

  • maggiesurbanfarm.com

  • backmyplay.com

  • taootop.com

  • riad-libitibito.com

  • nandemo-system.com

  • fastpeoesearch.com

  • thekasharab.com

  • 8hapi.com

Targets

    • Target
      file.xe
    • Size 751KB
    • SHA256 0c3afc73b1560d5d817104a616325e9f7a825e6b0158dfa0469b423c8bfbdf64
    • MD5 SHA1 SHA512
    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook Payload

    • Deletes itself

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks