General

  • Target
    d0b2e715c3e584846f591401035609b4.exe
  • Size 983KB
  • Sample210114-kf6d7q4e5s
  • SHA256 3579fdebe1647aa6a9172a2d808fa43b66a9ebc0e09aba02e1ed70d74dad67e2
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • formbook

C2
  • http://www.rizrvd.com/bw82/

Decoy
  • fundamentaliemef.com

  • gallerybrows.com

  • leadeligey.com

  • octoberx2.online

  • climaxnovels.com

  • gdsjgf.com

  • curateherstories.com

  • blacksailus.com

  • yjpps.com

  • gmobilet.com

  • fcoins.club

  • foreverlive2027.com

  • healthyfifties.com

  • wmarquezy.com

  • housebulb.com

  • thebabyfriendly.com

  • primajayaintiperkasa.com

  • learnplaychess.com

  • chrisbubser.digital

  • xn--avenr-wsa.com

Targets

    • Target
      d0b2e715c3e584846f591401035609b4.exe
    • Size 983KB
    • SHA256 3579fdebe1647aa6a9172a2d808fa43b66a9ebc0e09aba02e1ed70d74dad67e2
    • MD5 SHA1 SHA512
    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Xloader

      Xloader is a rebranded version of Formbook malware.

    • Xloader Payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks