General

  • Target
    962d09330a99ab3ef2bd10211d22391d.exe
  • Size 768KB
  • Sample201230-myqeh36bta
  • SHA256 9335b040e7823155fcde32d1cfd5268db42e2f9c191e2144269800adb2a820d8
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • formbook

C2
  • http://www.rizrvd.com/bw82/

Decoy
  • fundamentaliemef.com

  • gallerybrows.com

  • leadeligey.com

  • octoberx2.online

  • climaxnovels.com

  • gdsjgf.com

  • curateherstories.com

  • blacksailus.com

  • yjpps.com

  • gmobilet.com

  • fcoins.club

  • foreverlive2027.com

  • healthyfifties.com

  • wmarquezy.com

  • housebulb.com

  • thebabyfriendly.com

  • primajayaintiperkasa.com

  • learnplaychess.com

  • chrisbubser.digital

  • xn--avenr-wsa.com

Targets

    • Target
      962d09330a99ab3ef2bd10211d22391d.exe
    • Size 768KB
    • SHA256 9335b040e7823155fcde32d1cfd5268db42e2f9c191e2144269800adb2a820d8
    • MD5 SHA1 SHA512
    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Xloader

      Xloader is a rebranded version of Formbook malware.

    • Xloader Payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks