General

  • Target

    7a1b8316f5ab5e580a39374469dd8029949c791b6ac33627b3824868bd5aaf28

  • Size

    315KB

  • Sample

    211113-mg8gwabhcl

  • MD5

    7d22b7632fc02e12438e7748eca086b4

  • SHA1

    e7e9f311c61a9aa1537053e96f9b8f5273c47dee

  • SHA256

    7a1b8316f5ab5e580a39374469dd8029949c791b6ac33627b3824868bd5aaf28

  • SHA512

    fdb1785372411642b8479bc54b83262a04cdc78fb4ca372fb6d81b0e0c876b06a3b83475a6d7d41f103bf4c2285bab08b67ce70bde6f4fef2d9f8c70b6cbad3f

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

kzk9

C2

http://www.yourmajordomo.com/kzk9/

Decoy

tianconghuo.club

1996-page.com

ourtownmax.net

conservativetreehose.com

synth.repair

donnachicacreperia.com

tentfull.com

weapp.download

surfersink.com

gattlebusinessservices.com

sebastian249.com

anhphuc.company

betternatureproducts.net

defroplate.com

seattlesquidsquad.com

polarjob.com

lendingadvantage.com

angelsondope.com

goportjitney.com

tiendagrupojagr.com

Targets

    • Target

      7a1b8316f5ab5e580a39374469dd8029949c791b6ac33627b3824868bd5aaf28

    • Size

      315KB

    • MD5

      7d22b7632fc02e12438e7748eca086b4

    • SHA1

      e7e9f311c61a9aa1537053e96f9b8f5273c47dee

    • SHA256

      7a1b8316f5ab5e580a39374469dd8029949c791b6ac33627b3824868bd5aaf28

    • SHA512

      fdb1785372411642b8479bc54b83262a04cdc78fb4ca372fb6d81b0e0c876b06a3b83475a6d7d41f103bf4c2285bab08b67ce70bde6f4fef2d9f8c70b6cbad3f

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook Payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks