General

  • Target
    08554cb035e1c8f14b980019ffae237c.exe
  • Size 1.4MB
  • Sample210119-9kaaqact8a
  • SHA256 a243e6a605d8bb403f4cacb90a290d8f415d523dcc3c6eeedcf72f5cf803efa4
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • formbook

C2
  • http://www.stonescapes1.com/de92/

Decoy
  • zindaginews.com

  • tyelevator.com

  • schustermaninterests.com

  • algemixdelchef.com

  • doubscollectivites.com

  • e-butchery.com

  • hellbentmask.com

  • jumbpprivacy.com

  • teeniestiedye.com

  • playfulartwork.com

  • desertvacahs.com

  • w5470-hed.net

  • nepalearningpods.com

  • smoothandsleek.com

  • thecannaglow.com

  • torrentkittyla.com

  • industrytoyou.com

  • raquelvargas.net

  • rlc-nc.net

  • cryptoprises.com

Targets

    • Target
      08554cb035e1c8f14b980019ffae237c.exe
    • Size 1.4MB
    • SHA256 a243e6a605d8bb403f4cacb90a290d8f415d523dcc3c6eeedcf72f5cf803efa4
    • MD5 SHA1 SHA512
    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Xloader

      Xloader is a rebranded version of Formbook malware.

    • Xloader Payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks