General

  • Target

    763a170d8db1c54b150a0d2891b3fead.exe

  • Size

    879KB

  • Sample

    210112-aqkwh58gzj

  • MD5

    763a170d8db1c54b150a0d2891b3fead

  • SHA1

    a5e70c7ef5c972a5507b679c573e677ec7ba28a6

  • SHA256

    f53df4e1f9405d98a02cf34bedf2ee5df88437c130eb339eb6da9850f14ad443

  • SHA512

    c42af58504d08fdc7b62b84fbddc059f375aa97652b02627c93063d3940ebec33381fc08522f9e5dca09058237232933da6b62786ea800ff1c7591d6a815ce9b

Malware Config

Extracted

Family

formbook

C2

http://www.zglvyouzaixian.com/nki/

Decoy

igo-digiworld.com

infrahiit.com

herhealingwater.com

inspiredbytradition.com

onlinepropertyworld.com

rvwdj.com

mudahbikinsuhi.online

multipleofferonline.com

striveyouthministry.com

affectiveneuro.net

f21m.com

perfumefashion.icu

instantcash4rvs.com

help-verifiedbadge.com

solomonislandsblog.com

vipshoppingwizard.com

doggybargains.com

fjyaoxi.net

luxpropertyandassociates.com

companyfinders.com

Targets

    • Target

      763a170d8db1c54b150a0d2891b3fead.exe

    • Size

      879KB

    • MD5

      763a170d8db1c54b150a0d2891b3fead

    • SHA1

      a5e70c7ef5c972a5507b679c573e677ec7ba28a6

    • SHA256

      f53df4e1f9405d98a02cf34bedf2ee5df88437c130eb339eb6da9850f14ad443

    • SHA512

      c42af58504d08fdc7b62b84fbddc059f375aa97652b02627c93063d3940ebec33381fc08522f9e5dca09058237232933da6b62786ea800ff1c7591d6a815ce9b

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook Payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks