General

  • Target
    eff8d83878a21a67564864f6a4da8f66.exe
  • Size 563KB
  • Sample201109-akhera67q6
  • SHA256 568a6bfbf5ce68d84fba719dcbee920751fb52b24890c6a9f6258aa670026d07
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • formbook

C2
  • http://www.howndey.com/xd4/

Decoy
  • agimbahtiri.com

  • equostore.com

  • crazyisrelative.com

  • twins-mom.com

  • getawaygoat.com

  • assert.ltd

  • futuretehran.com

  • 83300298.com

  • viaffic.com

  • 977ck.com

  • 0pe641.com

  • capakinfluble.com

  • 2e51bf.top

  • amafilms.com

  • umbrellafit.com

  • jpennercorp.info

  • kyrarose.com

  • capitanesdelacalle.com

  • eypf84wqst.biz

  • theeugenenyc.us

Targets

    • Target
      eff8d83878a21a67564864f6a4da8f66.exe
    • Size 563KB
    • SHA256 568a6bfbf5ce68d84fba719dcbee920751fb52b24890c6a9f6258aa670026d07
    • MD5 SHA1 SHA512
    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook Payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks