General

  • Target

    93c377f5008833ebaf3f50983084a0e5.exe

  • Size

    561KB

  • Sample

    210114-9wgw9djwn6

  • MD5

    93c377f5008833ebaf3f50983084a0e5

  • SHA1

    0fe9b1de40e7f16c6b4654549a035e363f7844f5

  • SHA256

    edcbf58883f09441ef7eb461421b7ec33655663420ba2722ef5c45b62600f25c

  • SHA512

    ef08c4d8f766bf231b9bfaf2c7e8e6ed7470b7487886fe6859fef63040d754658b4cb6d6c05cbbfc2ddcafd03a8f61eb7530746d2df7a73c39482b2123380fa9

Malware Config

Extracted

Family

formbook

C2

http://www.learnhour.net/eaud/

Decoy

modshiro.com

mademarketingoss.com

austinjourls.info

wayupteam.com

crossingfinger.com

interseptors.com

gigashit.com

livetigo.com

halamankuningindonesia.com

windhammills.com

aylinahmet.com

mbacexonan.website

shopboxbarcelona.com

youyeslive.com

coonlinesportsbooks.com

guorunme.com

putlocker2.site

pencueaidnetwork.com

likevector.com

vulcanudachi-proclub.com

Targets

    • Target

      93c377f5008833ebaf3f50983084a0e5.exe

    • Size

      561KB

    • MD5

      93c377f5008833ebaf3f50983084a0e5

    • SHA1

      0fe9b1de40e7f16c6b4654549a035e363f7844f5

    • SHA256

      edcbf58883f09441ef7eb461421b7ec33655663420ba2722ef5c45b62600f25c

    • SHA512

      ef08c4d8f766bf231b9bfaf2c7e8e6ed7470b7487886fe6859fef63040d754658b4cb6d6c05cbbfc2ddcafd03a8f61eb7530746d2df7a73c39482b2123380fa9

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Xloader

      Xloader is a rebranded version of Formbook malware.

    • Xloader Payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks