General

  • Target
    ins.exe
  • Size 197KB
  • Sample201217-j2nvr3s4dx
  • SHA256 2d5d89747431e9003471e77e757e6c2d3310cbcac7451c1bb8389d0744543e6f
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • formbook

C2
  • http://www.nationshiphop.com/hko6/

Decoy
  • apartmentsineverettwa.com

  • forritcu.net

  • hotroodes.com

  • skinnerttc.com

  • royaltrustmyanmar.com

  • adreslog.com

  • kaysbridalboutiques.com

  • multitask-improvements.com

  • geniiforum.com

  • smarthomehatinh.asia

  • banglikeaboss.com

  • javlover.club

  • affiliateclubindia.com

  • mycapecoralhomevalue.com

  • comparamuebles.online

  • newrochellenissan.com

  • nairobi-paris.com

  • fwk.xyz

  • downdepot.com

  • nextgenmemorabilia.com

Targets

    • Target
      ins.exe
    • Size 197KB
    • SHA256 2d5d89747431e9003471e77e757e6c2d3310cbcac7451c1bb8389d0744543e6f
    • MD5 SHA1 SHA512
    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook Payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks