General

  • Target
    Editing Remittance copy.exe
  • Size 570KB
  • Sample201016-2xwxcjchrn
  • SHA256 77e828d113038623ccfca7e111b60675fd36ea404545f8ce828d7f8505244f0d
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • formbook

C2
  • http://www.jsbdistributor.com/u2e/

Decoy
  • aartihand.com

  • texasreloaded.com

  • 2794moraga.com

  • mybcinfo.com

  • wriz.xyz

  • headlundco.com

  • officialangelanichelle.com

  • danielledelaine.com

  • ateliermalibu.com

  • vantaimanhtruong.com

  • zhimazhiyun.com

  • saimeeraservices.com

  • baisongke.com

  • catearhelmet.com

  • palasian.net

  • merchantofzanzibar.com

  • ateliercrepin.com

  • guardtactics.com

  • ceritadata.com

  • nacesiti.com

Targets

    • Target
      Editing Remittance copy.exe
    • Size 570KB
    • SHA256 77e828d113038623ccfca7e111b60675fd36ea404545f8ce828d7f8505244f0d
    • MD5 SHA1 SHA512
    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook Payload

    • Deletes itself

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks