General

  • Target

    Consignment Details.exe

  • Size

    328KB

  • Sample

    210112-25nftv8382

  • MD5

    911e2991f8d0899edbba11364e064350

  • SHA1

    e58ecc5eb7388aed5b4d59ad3d5e317bcc44769b

  • SHA256

    148007b32a311769a958c3f87c6c836b14457f17dbe6a9a0188b0f68b3c30b40

  • SHA512

    f56aea41dc7d89472d60e21f90cbf261fcddf34b59790b0953e5d57b7e5d1668ea23f9e7f6336256bfef2ad0d9f187eec3776806eb94d1c7efc17de8dd375f86

Malware Config

Extracted

Family

formbook

C2

http://www.elevatedenterprizes.com/h3qo/

Decoy

dhflow.com

jyindex.com

ezcleanhandle.com

trungtamcongdong.online

simsprotectionagency.com

easylivemeet.com

blackvikingfashionhouse.com

52banxue.com

girlsinit.com

drhemo.com

freethefarmers.com

velvetrosephotography.com

geometricbotaniclas.com

skyandspirit.com

deltacomunicacao.com

mucademy.com

jaboilfieldsolutions.net

howtowinatblackjacknow.com

anytimegrowth.com

simranluthra.com

Targets

    • Target

      Consignment Details.exe

    • Size

      328KB

    • MD5

      911e2991f8d0899edbba11364e064350

    • SHA1

      e58ecc5eb7388aed5b4d59ad3d5e317bcc44769b

    • SHA256

      148007b32a311769a958c3f87c6c836b14457f17dbe6a9a0188b0f68b3c30b40

    • SHA512

      f56aea41dc7d89472d60e21f90cbf261fcddf34b59790b0953e5d57b7e5d1668ea23f9e7f6336256bfef2ad0d9f187eec3776806eb94d1c7efc17de8dd375f86

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Xloader

      Xloader is a rebranded version of Formbook malware.

    • Xloader Payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks