General

  • Target
    SecuriteInfo.com.Trojan.PackedNET.509.28611.29307
  • Size 1.2MB
  • Sample210119-cdc4f8rm52
  • SHA256 16160e8686be9eefc11ffc8eafdabfbcda53784d95d1b747717cbb90acaa04d4
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • formbook

C2
  • http://www.vitajwb.com/irux/

Decoy
  • heteltht.com

  • transbordaquemultiplica.com

  • ispartakulecleaner.com

  • woodcutter.website

  • gy88api8888.com

  • forsagemagic.com

  • greenqobbler.com

  • piligame.com

  • pcbet333.com

  • superpuzzlegames.com

  • jameslearyrealestate.com

  • acmarketinghacks.com

  • world-travel.xyz

  • sprayfoampocatello.com

  • anshangbao.com

  • qacpilotacademy.com

  • aodaicali.com

  • aarusystems.com

  • potion-designs.com

  • bajaenvocho.com

Targets

    • Target
      SecuriteInfo.com.Trojan.PackedNET.509.28611.29307
    • Size 1.2MB
    • SHA256 16160e8686be9eefc11ffc8eafdabfbcda53784d95d1b747717cbb90acaa04d4
    • MD5 SHA1 SHA512
    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook Payload

    • Executes dropped EXE

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks