General

  • Target
    206bd87d584bf5c2fd2b6f3c80727fb5.exe
  • Size 797KB
  • Sample210112-p25vbwdbwx
  • SHA256 e347dfe07b91ef2835e5de0f8e47df31647be4558adbe842b244a8384f0f59d2
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • formbook

C2
  • http://www.bodyfuelrtd.com/8rg4/

Decoy
  • fakecostasunglasses.com

  • twinbrothers.pizza

  • jizhoujsp.com

  • qscrit.com

  • hotelmanise.com

  • fer-ua.online

  • europserver-simcloud.systems

  • redwap2.pro

  • betwalkoffame.com

  • latashalovemillionaire.com

  • 8million-lr.com

  • tomatrader.com

  • modaluxcutabovefitness.com

  • shishijiazu.com

  • cckytx.com

  • reversehomeloansmiami.com

  • imaginenationnetwork.com

  • thecyclistshop.com

  • jorgegiljewelry.com

  • hlaprotiens.com

Targets

    • Target
      206bd87d584bf5c2fd2b6f3c80727fb5.exe
    • Size 797KB
    • SHA256 e347dfe07b91ef2835e5de0f8e47df31647be4558adbe842b244a8384f0f59d2
    • MD5 SHA1 SHA512
    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Xloader

      Xloader is a rebranded version of Formbook malware.

    • Xloader Payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks