General

  • Target
    d8569483495c1402ecaf9f0b91a7ded2.exe
  • Size 1.1MB
  • Sample201217-1ddqs692d2
  • SHA256 f64ecad45aae27f037e819a6adfaeebbdf0f769690a46a89a29d4f0da22b6cd4
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • formbook

C2
  • http://www.switchtoambitwithmirtha.com/jskg/

Decoy
  • jajaten.com

  • pnorg.net

  • rccarquibogota.com

  • marcomarabiamea.com

  • theligue.com

  • mdearpet.com

  • barokahsrivillage.com

  • wisdomtoothguru.com

  • srteamsex.com

  • erotictoybox.com

  • 278698.com

  • victimaccidents.com

  • bootyfashions.com

  • stomasto.site

  • canalysisconsulting.com

  • printandmail.legal

  • bestcureforbackpain.com

  • apanifitness.com

  • smartabletech.com

  • facialsteamerofficial.com

Targets

    • Target
      d8569483495c1402ecaf9f0b91a7ded2.exe
    • Size 1.1MB
    • SHA256 f64ecad45aae27f037e819a6adfaeebbdf0f769690a46a89a29d4f0da22b6cd4
    • MD5 SHA1 SHA512
    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Xloader

      Xloader is a rebranded version of Formbook malware.

    • Xloader Payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks