General

  • Target
    Y75vU558UfuGbzM.exe
  • Size 1.1MB
  • Sample210118-9p5a5gp27j
  • SHA256 ba32ea25e0244b93232b89ed81d366b43455e370378777c8d43a094ac529282e
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • formbook

C2
  • http://www.allismd.com/ur06/

Decoy
  • philippebrooksdesign.com

  • cmoorestudio.com

  • profille-sarina23tammara.club

  • dqulxe.com

  • uiffinger.com

  • nolarapper.com

  • maconanimalexterminator.com

  • bisovka.com

  • loveisloveent.com

  • datication.com

  • spxo66.com

  • drhelpnow.com

  • ladybug-cle.com

  • macocome.com

  • thepoppysocks.com

  • eldritchparadox.com

  • mercadolibre.company

  • ismartfarm.com

  • kansascarlot.com

  • kevinld.com

Targets

    • Target
      Y75vU558UfuGbzM.exe
    • Size 1.1MB
    • SHA256 ba32ea25e0244b93232b89ed81d366b43455e370378777c8d43a094ac529282e
    • MD5 SHA1 SHA512
    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Xloader

      Xloader is a rebranded version of Formbook malware.

    • Xloader Payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks