General

  • Target
    27e82e5a6ba22fd144a1aa0499ae1acd
  • Size 289KB
  • Sample211007-mh8t2aceak
  • SHA256 5fd22c8bf1e7e06ccaa6ebc23410086fe0e3bc30b1613cd6ee734f280c0d6979
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • formbook

Version
  • 4.1

Campaign
  • nk6l

C2
  • http://www.rthearts.com/nk6l/

Decoy
  • cbnextra.com

  • entitysystemsinc.com

  • 55midwoodave.com

  • ebelizzi.com

  • khojcity.com

  • 1527brokenoakdrive.site

  • housinghproperties.com

  • ratiousa.com

  • lrcrepresentacoes.net

  • tocoec.net

  • khadamatdemnate.com

  • davidkastner.xyz

  • gardeniaresort.com

  • qiantangguoji.com

  • visaprepaidprocessinq.com

  • cristinamadara.com

  • semapisus.xyz

  • mpwebagency.net

  • alibabasdeli.com

  • gigasupplies.com

Targets

    • Target
      27e82e5a6ba22fd144a1aa0499ae1acd
    • Size 289KB
    • SHA256 5fd22c8bf1e7e06ccaa6ebc23410086fe0e3bc30b1613cd6ee734f280c0d6979
    • MD5 SHA1 SHA512
    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook Payload

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks