General

  • Target
    2577a2097b467fa80f6d5dc19bf01928.exe
  • Size 432KB
  • Sample201109-e2qkgk334s
  • SHA256 be100d30450e36b7bdded9c44514e7d3bcf9b24d9ef7f07f1ed6f4b1f9cbf930
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • formbook

C2
  • http://www.nimtax.com/ut/

Decoy
  • testestes.com

  • taihaogame.com

  • onlinecomedians.com

  • cheapest-pricelevitra-buy.com

  • ohioriverboats.com

  • heimac100.com

  • justicejava.com

  • lisaseansadvancedskincare.com

  • pattymeyerphotography.com

  • yogijobs.com

  • timelessbabez.com

  • aliandanusha.com

  • comaan.net

  • calomio.com

  • 654we.com

  • charlottesballoons.com

  • ageingtech.com

  • ktdlh.info

  • lafermedecamelia.com

  • ido-expo.com

Targets

    • Target
      2577a2097b467fa80f6d5dc19bf01928.exe
    • Size 432KB
    • SHA256 be100d30450e36b7bdded9c44514e7d3bcf9b24d9ef7f07f1ed6f4b1f9cbf930
    • MD5 SHA1 SHA512
    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook Payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks