General

  • Target
    Inquiry.exe.exe
  • Size 395KB
  • Sample201109-vcphv53p9n
  • SHA256 df2bbdd833be8896f46c8660acfc9da2711f2a75d8338240b781fc6ee3964f9e
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • formbook

C2
  • http://www.joomlas123.com/4vx/

Decoy
  • kontinuer.com

  • outofthebluelove.com

  • docentrood.com

  • emowm.com

  • jsa862.net

  • kshoworld.com

  • kumsalkorel.com

  • adrigh.info

  • goldentrianglerv.com

  • youkuy.com

  • lindaclijsters.com

  • audreyfarley.com

  • alasitter.com

  • uscar-boerse.com

  • successwithfletch.com

  • 474opebet.com

  • xjlfb.com

  • doingworkabroad.com

  • 0pe864.com

  • ittestperfumeok.live

Targets

    • Target
      Inquiry.exe.exe
    • Size 395KB
    • SHA256 df2bbdd833be8896f46c8660acfc9da2711f2a75d8338240b781fc6ee3964f9e
    • MD5 SHA1 SHA512
    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook Payload

    • Deletes itself

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks