General

  • Target
    44363510532b87427a7fc159ca439176.exe
  • Size 1.6MB
  • Sample201211-np29vw5ymx
  • SHA256 b01bf425f19ea4b934bdbb4b8d2670748a399ff84e48200b7aa382d70068fbc1
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • formbook

C2
  • http://www.herbmedia.net/csv8/

Decoy
  • slgacha.com

  • oohdough.com

  • 6983ylc.com

  • aykassociate.com

  • latin-hotspot.com

  • starrockindia.com

  • beamsubway.com

  • queensboutique1000.com

  • madbaddie.com

  • bhoomimart.com

  • ankitparivar.com

  • aldanasanchezmx.com

  • citest1597669833.com

  • cristianofreitas.com

  • myplantus.com

  • counterfeitmilk.com

  • 8xf39.com

  • pregnantwomens.com

  • yyyut6.com

  • stnanguo.com

Targets

    • Target
      44363510532b87427a7fc159ca439176.exe
    • Size 1.6MB
    • SHA256 b01bf425f19ea4b934bdbb4b8d2670748a399ff84e48200b7aa382d70068fbc1
    • MD5 SHA1 SHA512
    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Xloader

      Xloader is a rebranded version of Formbook malware.

    • Xloader Payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks