General

  • Target

    0b50a75467d375b948edc7bcb6f01b60.exe

  • Size

    273KB

  • Sample

    211210-qxyt6ahhhm

  • MD5

    0b50a75467d375b948edc7bcb6f01b60

  • SHA1

    d9d70c204806b74acf34e95e44f5528031e777a6

  • SHA256

    b13782a081582cd40a427da82c93035d3a59cd7dffea1e9b3f3821c55fde233c

  • SHA512

    267933362fd75201a23c33b075045f564871fe9a8ee3681a515ae1e5abb29686015274919a0db92a33b78d0cc0566bfffde47cd1906834ea912dc298cdc5c7ad

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

nk6l

C2

http://www.rthearts.com/nk6l/

Decoy

cbnextra.com

entitysystemsinc.com

55midwoodave.com

ebelizzi.com

khojcity.com

1527brokenoakdrive.site

housinghproperties.com

ratiousa.com

lrcrepresentacoes.net

tocoec.net

khadamatdemnate.com

davidkastner.xyz

gardeniaresort.com

qiantangguoji.com

visaprepaidprocessinq.com

cristinamadara.com

semapisus.xyz

mpwebagency.net

alibabasdeli.com

gigasupplies.com

Targets

    • Target

      0b50a75467d375b948edc7bcb6f01b60.exe

    • Size

      273KB

    • MD5

      0b50a75467d375b948edc7bcb6f01b60

    • SHA1

      d9d70c204806b74acf34e95e44f5528031e777a6

    • SHA256

      b13782a081582cd40a427da82c93035d3a59cd7dffea1e9b3f3821c55fde233c

    • SHA512

      267933362fd75201a23c33b075045f564871fe9a8ee3681a515ae1e5abb29686015274919a0db92a33b78d0cc0566bfffde47cd1906834ea912dc298cdc5c7ad

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook Payload

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks