General

  • Target
    7c23c9726e93d53e3f7fab8650b8329f
  • Size 199KB
  • Sample201025-tppaqkdkta
  • SHA256 56a403d1e2f2fcf7c7416c65eb1ec5d6b9e6906c0c9570ac89e703bc9f2ce37e
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • formbook

C2
  • http://www.mage-cart.info/d9s8/

Decoy
  • dengken.net

  • mifrio.com

  • testingin01beta.biz

  • upsidedownspeaking.net

  • 808manx.com

  • tacticalthieves.com

  • hairbyedy.com

  • freddyrentcar.com

  • pacificbrandsuk.com

  • vienesta.com

  • juzi007.com

  • masterclasslaunchformula.com

  • sentrahidroponik.com

  • n-riched.com

  • codingcaptor.net

  • artisanal-wines.com

  • dreamycosmetics.com

  • cryptoxpace.com

  • honezanz.biz

  • rocknbpropertymanagement.com

Targets

    • Target
      7c23c9726e93d53e3f7fab8650b8329f
    • Size 199KB
    • SHA256 56a403d1e2f2fcf7c7416c65eb1ec5d6b9e6906c0c9570ac89e703bc9f2ce37e
    • MD5 SHA1 SHA512
    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Modifies system executable filetype association

    • Formbook Payload

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

MITRE ATT&CK Enterprise v6

Tasks