General

  • Target

    bcc528aa9392adaf0ad84a8c70a5c07d.exe

  • Size

    1.0MB

  • Sample

    210121-dkplv75pex

  • MD5

    bcc528aa9392adaf0ad84a8c70a5c07d

  • SHA1

    33a17b53cb865dc6e8cfaf3e37242ed038bf82ba

  • SHA256

    c73732f1e8d7aff13f1c0ef733d9d4734ad81b12f27b414f0412204eb3373c71

  • SHA512

    ade19bf7311acef78dcf3cc79f6a79f7d0e2b962913f63d1476e370fb4f363ce83dcb55df1bbc0f6b60a33a8ab654efb117cebcf1a24602a81950502ccc7b5a3

Malware Config

Extracted

Family

formbook

C2

http://www.bodyfuelrtd.com/8rg4/

Decoy

fakecostasunglasses.com

twinbrothers.pizza

jizhoujsp.com

qscrit.com

hotelmanise.com

fer-ua.online

europserver-simcloud.systems

redwap2.pro

betwalkoffame.com

latashalovemillionaire.com

8million-lr.com

tomatrader.com

modaluxcutabovefitness.com

shishijiazu.com

cckytx.com

reversehomeloansmiami.com

imaginenationnetwork.com

thecyclistshop.com

jorgegiljewelry.com

hlaprotiens.com

Targets

    • Target

      bcc528aa9392adaf0ad84a8c70a5c07d.exe

    • Size

      1.0MB

    • MD5

      bcc528aa9392adaf0ad84a8c70a5c07d

    • SHA1

      33a17b53cb865dc6e8cfaf3e37242ed038bf82ba

    • SHA256

      c73732f1e8d7aff13f1c0ef733d9d4734ad81b12f27b414f0412204eb3373c71

    • SHA512

      ade19bf7311acef78dcf3cc79f6a79f7d0e2b962913f63d1476e370fb4f363ce83dcb55df1bbc0f6b60a33a8ab654efb117cebcf1a24602a81950502ccc7b5a3

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Xloader

      Xloader is a rebranded version of Formbook malware.

    • Xloader Payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks