General

  • Target

    inxx.exe

  • Size

    412KB

  • Sample

    210112-mx6n8bfkm6

  • MD5

    99ec724b02038cb9afa938c61bf0c4d5

  • SHA1

    36696bf0da5c4d6bb751018182648fc16e46d79a

  • SHA256

    0618ad213a6ce0e3dcaa65f80e4379953c38f97dbeccad081b5decc1dce38849

  • SHA512

    821a8fef0e1955fab9227d306e161fc393215146955413150fa47216f80b52c7c5c3bb28c155c792f13c0848bd2d1d1b3dd9768f67e789e9c085835c8386c40a

Malware Config

Extracted

Family

formbook

C2

http://www.besthandstool.icu/uds2/

Decoy

hrrecruitertraining.com

pancakeroll.club

equiposddl.com

fab-9corporation.com

seanformo.com

fisika-uinam.com

cheeseburgerpasta.com

cherylkarlfineartist.com

wunderprodukte.net

3912699.com

sanitizyo.com

856381190.xyz

aprobet42.xyz

knutsfastigheter.com

disalvospizzaitalian.com

energysavingsolarpower.com

oldwonderful.com

se32688.com

samkecollection.com

colegioreynosa.com

Targets

    • Target

      inxx.exe

    • Size

      412KB

    • MD5

      99ec724b02038cb9afa938c61bf0c4d5

    • SHA1

      36696bf0da5c4d6bb751018182648fc16e46d79a

    • SHA256

      0618ad213a6ce0e3dcaa65f80e4379953c38f97dbeccad081b5decc1dce38849

    • SHA512

      821a8fef0e1955fab9227d306e161fc393215146955413150fa47216f80b52c7c5c3bb28c155c792f13c0848bd2d1d1b3dd9768f67e789e9c085835c8386c40a

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook Payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks