General

  • Target

    2d21e970df7a629322de2c466d276d3a36f5bc742800459a76a12a7d71575f88

  • Size

    519KB

  • Sample

    211022-dbtxvsbhgl

  • MD5

    8841b1ae5968f38059f8acc8e53c982a

  • SHA1

    8aca7316435c75b0e8e5f453f9b93572afe64b6b

  • SHA256

    2d21e970df7a629322de2c466d276d3a36f5bc742800459a76a12a7d71575f88

  • SHA512

    994fee7c54b995caf22dfae31f3b6102077e59c49929a426f0b604f55d62c727b01c7c9c8bf8cf53cbcbf9239401554b39665cf8e8868fb57f44ffbe8aa96953

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

kzk9

C2

http://www.yourmajordomo.com/kzk9/

Decoy

tianconghuo.club

1996-page.com

ourtownmax.net

conservativetreehose.com

synth.repair

donnachicacreperia.com

tentfull.com

weapp.download

surfersink.com

gattlebusinessservices.com

sebastian249.com

anhphuc.company

betternatureproducts.net

defroplate.com

seattlesquidsquad.com

polarjob.com

lendingadvantage.com

angelsondope.com

goportjitney.com

tiendagrupojagr.com

Targets

    • Target

      2d21e970df7a629322de2c466d276d3a36f5bc742800459a76a12a7d71575f88

    • Size

      519KB

    • MD5

      8841b1ae5968f38059f8acc8e53c982a

    • SHA1

      8aca7316435c75b0e8e5f453f9b93572afe64b6b

    • SHA256

      2d21e970df7a629322de2c466d276d3a36f5bc742800459a76a12a7d71575f88

    • SHA512

      994fee7c54b995caf22dfae31f3b6102077e59c49929a426f0b604f55d62c727b01c7c9c8bf8cf53cbcbf9239401554b39665cf8e8868fb57f44ffbe8aa96953

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook Payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Collection

    Command and Control

      Credential Access

        Defense Evasion

          Discovery

            Execution

              Exfiltration

                Impact

                  Initial Access

                    Lateral Movement

                      Persistence

                        Privilege Escalation