General

  • Target
    Tracking No_SINI0068206497.exe
  • Size 1.0MB
  • Sample201124-fdtfrcedz2
  • SHA256 ef84b1824587f465b36bafcbfbe6a14953e6de0a9420904662ba207984782c80
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • formbook

C2
  • http://www.libertraxengineering.com/rte/

Decoy
  • thecreditcardcon.com

  • bcoltee.com

  • lyckaffe.com

  • lifebonusclub.com

  • hellolovelybookbox.net

  • robinsnesting.com

  • bunda7.com

  • showrov.online

  • mdfs.club

  • int-bp-departmt.com

  • grannymodern.com

  • bestdiany.com

  • inviotraffico.site

  • nymonroy.com

  • barberstradale.com

  • arvivsurgery.com

  • stylinglives.com

  • idealonerealty.com

  • riedelman.com

  • multicommerces.com

Targets

    • Target
      Tracking No_SINI0068206497.exe
    • Size 1.0MB
    • SHA256 ef84b1824587f465b36bafcbfbe6a14953e6de0a9420904662ba207984782c80
    • MD5 SHA1 SHA512
    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook Payload

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks