General

  • Target
    be84c387975b024f25dc96ec5f85f7bd.exe
  • Size 619KB
  • Sample210129-jpdvvll61n
  • SHA256 ebbcc767acc5337309a6f0770c52236b131cbcffb3e843e4bf132489cb2001cc
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • formbook

C2
  • http://www.rizrvd.com/bw82/

Decoy
  • fundamentaliemef.com

  • gallerybrows.com

  • leadeligey.com

  • octoberx2.online

  • climaxnovels.com

  • gdsjgf.com

  • curateherstories.com

  • blacksailus.com

  • yjpps.com

  • gmobilet.com

  • fcoins.club

  • foreverlive2027.com

  • healthyfifties.com

  • wmarquezy.com

  • housebulb.com

  • thebabyfriendly.com

  • primajayaintiperkasa.com

  • learnplaychess.com

  • chrisbubser.digital

  • xn--avenr-wsa.com

Targets

    • Target
      be84c387975b024f25dc96ec5f85f7bd.exe
    • Size 619KB
    • SHA256 ebbcc767acc5337309a6f0770c52236b131cbcffb3e843e4bf132489cb2001cc
    • MD5 SHA1 SHA512
    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Xloader

      Xloader is a rebranded version of Formbook malware.

    • Xloader Payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks