General

  • Target
    SecuriteInfo.com.Trojan.Win32.Save.a.9130.4062
  • Size 913KB
  • Sample210507-3m1wgew23e
  • SHA256 7653e46e3326fbabf9e534cbd02600f87ad38b5c9e4e175a60e27a6d90c5e6fe
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • formbook

Version
  • 4.1

C2
  • http://www.conciergedoctx.com/ot8m/

Decoy
  • digiclan.net

  • songlautramtuoii.online

  • miracleseedproducts.com

  • taniacastillo.com

  • essentialme.network

  • charmcitydetour.com

  • suprekopis.com

  • jimmycollier.com

  • thrifteee.com

  • rhmachinery.ltd

  • the05project.com

  • altfacebookalt.com

  • ein-herz-fuer-holz.com

  • kingohost.com

  • vmarines.com

  • 2bestudio.com

  • triducdv.com

  • kp-transport.com

  • mybostonhwart.com

  • benzcat.net

Targets

    • Target
      SecuriteInfo.com.Trojan.Win32.Save.a.9130.4062
    • Size 913KB
    • SHA256 7653e46e3326fbabf9e534cbd02600f87ad38b5c9e4e175a60e27a6d90c5e6fe
    • MD5 SHA1 SHA512
    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook Payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks