General

  • Target
    963f555140e20e291c2fac67a5186c15.exe
  • Size 752KB
  • Sample201214-7h1we2kfdj
  • SHA256 bbe42dcd5a1d942b3267093fba6232d48183c82500a67e03905864bcbe68b609
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • formbook

C2
  • http://www.rizrvd.com/bw82/

Decoy
  • fundamentaliemef.com

  • gallerybrows.com

  • leadeligey.com

  • octoberx2.online

  • climaxnovels.com

  • gdsjgf.com

  • curateherstories.com

  • blacksailus.com

  • yjpps.com

  • gmobilet.com

  • fcoins.club

  • foreverlive2027.com

  • healthyfifties.com

  • wmarquezy.com

  • housebulb.com

  • thebabyfriendly.com

  • primajayaintiperkasa.com

  • learnplaychess.com

  • chrisbubser.digital

  • xn--avenr-wsa.com

Targets

    • Target
      963f555140e20e291c2fac67a5186c15.exe
    • Size 752KB
    • SHA256 bbe42dcd5a1d942b3267093fba6232d48183c82500a67e03905864bcbe68b609
    • MD5 SHA1 SHA512
    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Xloader

      Xloader is a rebranded version of Formbook malware.

    • Xloader Payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks