General

  • Target
    6b0128e753b4c8eb55a0726dbdbbf35e.exe
  • Size 1.0MB
  • Sample210113-h2xpcmfwdx
  • SHA256 0ae22d4877231b64b2e9e1252bbe8636ea43fe5692ca899733e715ccfc82e224
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • formbook

C2
  • http://www.zglvyouzaixian.com/nki/

Decoy
  • igo-digiworld.com

  • infrahiit.com

  • herhealingwater.com

  • inspiredbytradition.com

  • onlinepropertyworld.com

  • rvwdj.com

  • mudahbikinsuhi.online

  • multipleofferonline.com

  • striveyouthministry.com

  • affectiveneuro.net

  • f21m.com

  • perfumefashion.icu

  • instantcash4rvs.com

  • help-verifiedbadge.com

  • solomonislandsblog.com

  • vipshoppingwizard.com

  • doggybargains.com

  • fjyaoxi.net

  • luxpropertyandassociates.com

  • companyfinders.com

Targets

    • Target
      6b0128e753b4c8eb55a0726dbdbbf35e.exe
    • Size 1.0MB
    • SHA256 0ae22d4877231b64b2e9e1252bbe8636ea43fe5692ca899733e715ccfc82e224
    • MD5 SHA1 SHA512
    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook Payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks