General

  • Target

    4310b5640ee8ea88007a978540a32129.exe

  • Size

    1.4MB

  • Sample

    210120-xy8rshpvva

  • MD5

    4310b5640ee8ea88007a978540a32129

  • SHA1

    35f274fd4675267afb9c29c38896cc7ea9f10e34

  • SHA256

    d4dc8610837799abecadc4d3db1f6a8cbbce340de07b90e9868603f50c7fe762

  • SHA512

    eeddf53ea3a22ca9e4fc6ee8cf451a3cc70ffb58026ef3b97bf13fb1b101f0b603bf7987bd84873f467ab0f976af95b77170a78abbde410dc44a3fdb727d485d

Malware Config

Extracted

Family

formbook

C2

http://www.thedilleyo.com/kb8/

Decoy

goodsforbuilders.com

dafuhe.com

parapharmacity.com

montclairymcamotionvibe.com

jamesmccloudart.com

reignfallentertainment.com

couplesforequality.com

pitchbop.com

minipresspaperco.com

venoam.com

so-paradise.com

surgeryprovider.com

donaldscareers.com

disney-funlife.com

biosolo.net

themodsmith.net

grandhawaiian.com

11mountains.com

immatesearch.com

stochastichq.com

Targets

    • Target

      4310b5640ee8ea88007a978540a32129.exe

    • Size

      1.4MB

    • MD5

      4310b5640ee8ea88007a978540a32129

    • SHA1

      35f274fd4675267afb9c29c38896cc7ea9f10e34

    • SHA256

      d4dc8610837799abecadc4d3db1f6a8cbbce340de07b90e9868603f50c7fe762

    • SHA512

      eeddf53ea3a22ca9e4fc6ee8cf451a3cc70ffb58026ef3b97bf13fb1b101f0b603bf7987bd84873f467ab0f976af95b77170a78abbde410dc44a3fdb727d485d

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook Payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks