General

  • Target

    7b57c26a8208756f37e8df8331f94610.exe

  • Size

    605KB

  • Sample

    211013-lpc59sdhe7

  • MD5

    7b57c26a8208756f37e8df8331f94610

  • SHA1

    bfb4a9e25f36ade44b084706da30c3f305d65609

  • SHA256

    0cf11de8a0ce67a46203ae419f2aa7bb988ae3088dc4f33158dccc55b97e4a7d

  • SHA512

    28aa1f10114bec29af3b55aaa17146f5f7daf6814891269c06545a0627bcedf19130b7e5454f2cbdf370525b272e2e6d6ec04c09bcc540903c482e4473025b7f

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

kzk9

C2

http://www.yourmajordomo.com/kzk9/

Decoy

tianconghuo.club

1996-page.com

ourtownmax.net

conservativetreehose.com

synth.repair

donnachicacreperia.com

tentfull.com

weapp.download

surfersink.com

gattlebusinessservices.com

sebastian249.com

anhphuc.company

betternatureproducts.net

defroplate.com

seattlesquidsquad.com

polarjob.com

lendingadvantage.com

angelsondope.com

goportjitney.com

tiendagrupojagr.com

Targets

    • Target

      7b57c26a8208756f37e8df8331f94610.exe

    • Size

      605KB

    • MD5

      7b57c26a8208756f37e8df8331f94610

    • SHA1

      bfb4a9e25f36ade44b084706da30c3f305d65609

    • SHA256

      0cf11de8a0ce67a46203ae419f2aa7bb988ae3088dc4f33158dccc55b97e4a7d

    • SHA512

      28aa1f10114bec29af3b55aaa17146f5f7daf6814891269c06545a0627bcedf19130b7e5454f2cbdf370525b272e2e6d6ec04c09bcc540903c482e4473025b7f

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook Payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks