General

  • Target
    c59292352ccbebbc63ea3c740a7981594b6e8dbea866e1c1c8f66b0a0aa61eba
  • Size 463KB
  • Sample201113-v1ftjqsjln
  • SHA256 c59292352ccbebbc63ea3c740a7981594b6e8dbea866e1c1c8f66b0a0aa61eba
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • formbook

C2
  • http://www.ozsmarthomes.com/iic6/

Decoy
  • screaminyourcarday.com

  • nbhindustriesptyltd.com

  • ntgmfublb.icu

  • bombayracks.com

  • phoenixlights.net

  • rachelamosphotography.com

  • leapforwards.net

  • sendai-salt.com

  • shabbychicflipsbyangelina.com

  • core-ol.com

  • canalysis.net

  • tybeeprohibitiontour.com

  • influencedarts.com

  • italivpn.com

  • newborn.today

  • garagedoorroundrocktx.com

  • participi.com

  • thegoddessnow.com

  • invesito.com

  • surfingnaked.com

Targets

    • Target
      c59292352ccbebbc63ea3c740a7981594b6e8dbea866e1c1c8f66b0a0aa61eba
    • Size 463KB
    • SHA256 c59292352ccbebbc63ea3c740a7981594b6e8dbea866e1c1c8f66b0a0aa61eba
    • MD5 SHA1 SHA512
    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook Payload

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks