General

  • Target
    90508db9aa3b3698eb08109217eb43b7.exe
  • Size 1.0MB
  • Sample201210-8s8qaddvyn
  • SHA256 b28f4495e2cda5a5fef0408701a136d820c7cf2e7a45dd101e70b31458e31530
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • formbook

C2
  • http://www.switchtoambitwithmirtha.com/jskg/

Decoy
  • jajaten.com

  • pnorg.net

  • rccarquibogota.com

  • marcomarabiamea.com

  • theligue.com

  • mdearpet.com

  • barokahsrivillage.com

  • wisdomtoothguru.com

  • srteamsex.com

  • erotictoybox.com

  • 278698.com

  • victimaccidents.com

  • bootyfashions.com

  • stomasto.site

  • canalysisconsulting.com

  • printandmail.legal

  • bestcureforbackpain.com

  • apanifitness.com

  • smartabletech.com

  • facialsteamerofficial.com

Targets

    • Target
      90508db9aa3b3698eb08109217eb43b7.exe
    • Size 1.0MB
    • SHA256 b28f4495e2cda5a5fef0408701a136d820c7cf2e7a45dd101e70b31458e31530
    • MD5 SHA1 SHA512
    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Xloader

      Xloader is a rebranded version of Formbook malware.

    • Xloader Payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks