General

  • Target

    b75247013200d602f98dc3801d2bde2f.exe

  • Size

    931KB

  • Sample

    210119-z524e2jdr2

  • MD5

    b75247013200d602f98dc3801d2bde2f

  • SHA1

    3327c5cd3ecd636b72c335166fe709b955a32285

  • SHA256

    8fe13da45a5732ae42c27687b9cf9105a3f2028857729bdfbe3ae31514a6b298

  • SHA512

    aa0b977c81b0e97433e61e21cc1e13cbc8821b5ff4d0b3e7554519051139dc661b4c9c0d8e99a6ff4148968d9f04653c85b411944f42fec29bdd4c70228229f9

Malware Config

Extracted

Family

formbook

C2

http://www.learnhour.net/eaud/

Decoy

modshiro.com

mademarketingoss.com

austinjourls.info

wayupteam.com

crossingfinger.com

interseptors.com

gigashit.com

livetigo.com

halamankuningindonesia.com

windhammills.com

aylinahmet.com

mbacexonan.website

shopboxbarcelona.com

youyeslive.com

coonlinesportsbooks.com

guorunme.com

putlocker2.site

pencueaidnetwork.com

likevector.com

vulcanudachi-proclub.com

Targets

    • Target

      b75247013200d602f98dc3801d2bde2f.exe

    • Size

      931KB

    • MD5

      b75247013200d602f98dc3801d2bde2f

    • SHA1

      3327c5cd3ecd636b72c335166fe709b955a32285

    • SHA256

      8fe13da45a5732ae42c27687b9cf9105a3f2028857729bdfbe3ae31514a6b298

    • SHA512

      aa0b977c81b0e97433e61e21cc1e13cbc8821b5ff4d0b3e7554519051139dc661b4c9c0d8e99a6ff4148968d9f04653c85b411944f42fec29bdd4c70228229f9

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Xloader

      Xloader is a rebranded version of Formbook malware.

    • Xloader Payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks