General

  • Target

    dllhost.exe

  • Size

    1.4MB

  • Sample

    210812-2naqc6rktx

  • MD5

    bb367436118b3298affddea50440ac12

  • SHA1

    b2b8d261784991e3c14c6577447362cb6d72634c

  • SHA256

    37f6df44b9dd38408fe5682c6d660eceb04a2915b3420576afce05bf3076bc01

  • SHA512

    f3549647a3e17bf9ca84e67e40311c3906e9b822f25567a434f8ae7ef737d0a10057ff5812fb293f4d2375b1da15b14458b33c3bcff92eb3599512757c1d638d

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

kzk9

C2

http://www.yourmajordomo.com/kzk9/

Decoy

tianconghuo.club

1996-page.com

ourtownmax.net

conservativetreehose.com

synth.repair

donnachicacreperia.com

tentfull.com

weapp.download

surfersink.com

gattlebusinessservices.com

sebastian249.com

anhphuc.company

betternatureproducts.net

defroplate.com

seattlesquidsquad.com

polarjob.com

lendingadvantage.com

angelsondope.com

goportjitney.com

tiendagrupojagr.com

Targets

    • Target

      dllhost.exe

    • Size

      1.4MB

    • MD5

      bb367436118b3298affddea50440ac12

    • SHA1

      b2b8d261784991e3c14c6577447362cb6d72634c

    • SHA256

      37f6df44b9dd38408fe5682c6d660eceb04a2915b3420576afce05bf3076bc01

    • SHA512

      f3549647a3e17bf9ca84e67e40311c3906e9b822f25567a434f8ae7ef737d0a10057ff5812fb293f4d2375b1da15b14458b33c3bcff92eb3599512757c1d638d

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • suricata: ET MALWARE FormBook CnC Checkin (GET)

      suricata: ET MALWARE FormBook CnC Checkin (GET)

    • Formbook Payload

    • Deletes itself

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks