General

  • Target
    Bank Details.exe
  • Size 854KB
  • Sample201105-bnv3jhtpmn
  • SHA256 70581c97768f831cf9a0e6e084f44331ffb3d17ed78136dcd6b42e0490b814bf
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • formbook

C2
  • http://www.alsagranit.info/rhk/

Decoy
  • luuthingoctrinam247.online

  • upcas.info

  • cmoswipefiles.com

  • rene-jew.com

  • kiddoslunchboxes.com

  • 52wanlol.com

  • konstela.com

  • dajiangzhibo11.com

  • huibaoyuanhty.com

  • boudot.one

  • myinfinitycollectionagency.com

  • letsgetsunny.com

  • gruppolarta.com

  • factoka.com

  • artistspal.com

  • gewnrecaalouine.com

  • etiquetadorada.com

  • brememshop.com

  • kangyiyan.com

  • testcitestdpp03.com

Targets

    • Target
      Bank Details.exe
    • Size 854KB
    • SHA256 70581c97768f831cf9a0e6e084f44331ffb3d17ed78136dcd6b42e0490b814bf
    • MD5 SHA1 SHA512
    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook Payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks