General

  • Target
    264989951f82d72d2201b806637b1616.exe
  • Size 673KB
  • Sample201109-mqs96xb4e2
  • SHA256 75549fad0671d97245ff745daa90f72d93b9518650b9a9b3cb174151ae0e335a
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • formbook

C2
  • http://www.chilogae.com/k2w/

Decoy
  • brittanybeck.com

  • idapple.mobi

  • sharoncement.win

  • smerchenko.com

  • citizenssenergygroup.com

  • landhawktactical.com

  • yilingshenghuo.com

  • lifa97.com

  • 8160pe.com

  • sf-purify.com

  • bloomingamaizing.com

  • thymeshares.com

  • rainwatercollectionhq.com

  • jaseba.net

  • whoistom.net

  • gn70.com

  • payperclickad.info

  • jessicagorbet.com

  • portlockproperty.com

  • mindset-beratung.com

Targets

    • Target
      264989951f82d72d2201b806637b1616.exe
    • Size 673KB
    • SHA256 75549fad0671d97245ff745daa90f72d93b9518650b9a9b3cb174151ae0e335a
    • MD5 SHA1 SHA512
    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook Payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks