General

  • Target

    7b5e02a2a7012cbdb1e2588740896860081c0044da0cc697db7839ae8d5d6a8e

  • Size

    516KB

  • Sample

    211022-kmyhrabdc4

  • MD5

    18c2161ecb305a851f25366ebeedd693

  • SHA1

    48c4e5b25938b067431d2d43229db647bcac0981

  • SHA256

    7b5e02a2a7012cbdb1e2588740896860081c0044da0cc697db7839ae8d5d6a8e

  • SHA512

    3725e39518c2f8f7a3a6dfd12ceee8cf0383dfaaeccfa9f181a2d7cbb9789839a012ffb958ba42eed429e9e01ce9a14f97925b8bc0c1e3a97eff3b2183e65851

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

kzk9

C2

http://www.yourmajordomo.com/kzk9/

Decoy

tianconghuo.club

1996-page.com

ourtownmax.net

conservativetreehose.com

synth.repair

donnachicacreperia.com

tentfull.com

weapp.download

surfersink.com

gattlebusinessservices.com

sebastian249.com

anhphuc.company

betternatureproducts.net

defroplate.com

seattlesquidsquad.com

polarjob.com

lendingadvantage.com

angelsondope.com

goportjitney.com

tiendagrupojagr.com

Targets

    • Target

      7b5e02a2a7012cbdb1e2588740896860081c0044da0cc697db7839ae8d5d6a8e

    • Size

      516KB

    • MD5

      18c2161ecb305a851f25366ebeedd693

    • SHA1

      48c4e5b25938b067431d2d43229db647bcac0981

    • SHA256

      7b5e02a2a7012cbdb1e2588740896860081c0044da0cc697db7839ae8d5d6a8e

    • SHA512

      3725e39518c2f8f7a3a6dfd12ceee8cf0383dfaaeccfa9f181a2d7cbb9789839a012ffb958ba42eed429e9e01ce9a14f97925b8bc0c1e3a97eff3b2183e65851

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook Payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks