General

  • Target
    9609200e202f371c2e981de8674c0374.exe
  • Size 210KB
  • Sample210217-3rjq68pzza
  • SHA256 149bc7bb666f2eabcf946822bd316709ddeeef787f059687415f98c71ad47783
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • formbook

C2
  • http://www.digitalneeds.tech/ivay/

Decoy
  • b4ukid.com

  • missioncontrol2030.com

  • chriswhitefoto.com

  • guepard-marine.com

  • getlauded.com

  • jingdonglm.com

  • clintlove.com

  • boldstrategicmedia.com

  • bluebay3dwdmall.com

  • aishag.com

  • forexexpoaward.com

  • basslakedisposal.com

  • bukannyaterbuai36.com

  • learntrhc.com

  • cancunpolo.com

  • case-cornershop.com

  • tahiticomplementos.com

  • dashanzhf.com

  • wholeholistichealth.com

  • inass-yassin.com

Targets

    • Target
      9609200e202f371c2e981de8674c0374.exe
    • Size 210KB
    • SHA256 149bc7bb666f2eabcf946822bd316709ddeeef787f059687415f98c71ad47783
    • MD5 SHA1 SHA512
    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Xloader

      Xloader is a rebranded version of Formbook malware.

    • Xloader Payload

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks