General

  • Target
    83faf9a9a0ebb09744f6530859aebff9
  • Size 1004KB
  • Sample201117-slje6zedhn
  • SHA256 e4974ddc809773cd725cfc7070ad545ddf4aa1fc211eb77a1eaae7b7fc1a019c
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • formbook

C2
  • http://www.alsagranit.info/rhk/

Decoy
  • luuthingoctrinam247.online

  • upcas.info

  • cmoswipefiles.com

  • rene-jew.com

  • kiddoslunchboxes.com

  • 52wanlol.com

  • konstela.com

  • dajiangzhibo11.com

  • huibaoyuanhty.com

  • boudot.one

  • myinfinitycollectionagency.com

  • letsgetsunny.com

  • gruppolarta.com

  • factoka.com

  • artistspal.com

  • gewnrecaalouine.com

  • etiquetadorada.com

  • brememshop.com

  • kangyiyan.com

  • testcitestdpp03.com

Targets

    • Target
      83faf9a9a0ebb09744f6530859aebff9
    • Size 1004KB
    • SHA256 e4974ddc809773cd725cfc7070ad545ddf4aa1fc211eb77a1eaae7b7fc1a019c
    • MD5 SHA1 SHA512
    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook Payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks