General

  • Target

    bb30a5dd4130b071fb4ca5f005371c63.exe

  • Size

    694KB

  • Sample

    201120-cxyd18pnax

  • MD5

    bb30a5dd4130b071fb4ca5f005371c63

  • SHA1

    52c3ca02828a4ad8e8dbf790a61b3d77379ad391

  • SHA256

    4c73fd4286e76a094eefafe5369f3a184ca4a38d567ae6dfad61645bf968a83f

  • SHA512

    062f184dea6b1327418b7030b114cc40bf21072408fb9408bc18b823bce73534cf513a566ef16f90c0379581fb9e189d8d39614334c04c1607afbc02089ac0d1

Malware Config

Extracted

Family

formbook

C2

http://www.digitalcashteam.com/glt/

Decoy

blingenterprises.net

opalthemovie.com

auctionpros.club

simplyfluffy.com

nanbuild.net

1extrafast.com

active-connector.xyz

ocewnbank.com

zekmer.com

6755e.com

ryry-s1.com

pastrami.house

shivamall.com

activateportusaludybelleza.com

homeprosrva.com

tessuto.net

christopherspecht.com

ti-an-dossen.com

universe.icu

healthmixtt.com

Targets

    • Target

      bb30a5dd4130b071fb4ca5f005371c63.exe

    • Size

      694KB

    • MD5

      bb30a5dd4130b071fb4ca5f005371c63

    • SHA1

      52c3ca02828a4ad8e8dbf790a61b3d77379ad391

    • SHA256

      4c73fd4286e76a094eefafe5369f3a184ca4a38d567ae6dfad61645bf968a83f

    • SHA512

      062f184dea6b1327418b7030b114cc40bf21072408fb9408bc18b823bce73534cf513a566ef16f90c0379581fb9e189d8d39614334c04c1607afbc02089ac0d1

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook Payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks