ThreatFox IOC Database
You are viewing the ThreatFox database entry for url http://www.camimac.com/poni/.
Database Entry
This IOC expired
This IOC is an old IOC and hence has expired on 2026-09-15 10:39:25 UTC. We therefore refrain from exporting it into our datasets. As a result, this database entry is purely informational and has no impact.
| IOC ID: | 245655 |
|---|---|
| IOC: | http://www.camimac.com/poni/ |
| IOC Type : | url |
| Threat Type : | botnet_cc |
| Malware: | Formbook |
| Malware alias: | win.xloader |
| Confidence Level : | Confidence level is high (100%) |
| Is compromised? : | False |
| First seen: | 2021-11-08 21:48:24 UTC |
| Last seen: | never |
| UUID: | 99141b33-40dd-11ec-8ab6-42010aa4000a |
| Reporter |  AndreGironda |
| Reward | 5 credits from ThreatFox |
| Tags: | xloader xmrig |
| Reference: | https://bazaar.abuse.ch/sample/160ea3850bd5f084c27aeeebae4ae027419d9e16c0cfdfdd951ca4c7d4f64dd6/ |
AndreGironda
MITRE T1566.001Date: Tue, 09 Nov 2021 02:00-02:30 +0900
Received: from www2249.sakura.ne.jp (182.48.49.189)
Message-Id: <202111081725.1A8HPe9o069278@www2249.sakura.ne.jp>
X-Authentication-Warning: www2249.sakura.ne.jp: gion-lupin set sender to contact@gion-lupin.com using -f
Subject: QUOTE REQUEST
From: عماد كاظم <contact@gion-lupin.com>
To: contact@gion-lupin.com
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="------_22065486561895d94555da_"
Content-Transfer-Encoding: 7bit
Return-Path: contact@gion-lupin.com
X-EOPAttributedMessage: 0
Attachment Name: POfile.xlsx
Maldoc SHA256: 8703a6cc8c74cdcbf0161b39c49d9a5574351704c200d3d609d8896fe04a1232
Maldoc Exploit Pack: CVE-2017-11882 CVE-2018-0798 CVE-2018-0802
$png_img_value_0 = {89504e470d0a1a0a0000000d4948445200000082000000b008020000004cd3210c0000200049444154789cecbd67985dc779265827c79bf3ed7b3b07744046032008022098442a5192654996bc235b92357e6c4b33bb}
$png_img_value_1 = {89504e470d0a1a0a0000000d4948445200000082000000b008020000004cd3210c0000200049444154789cedbd67705cd7793e7e76efddbbbd57546209a29020091204218a4da0489ac396b164d94a9c8c33d4389328}
$png_img_value_2 = {89504e470d0a1a0a0000000d4948445200000258000001320803000000113f5e4f0000015f504c5445000000fffffff0f0f1f7f7f8dadce1f7f7ecfefff4dee7edc6c9cbe7eed3e7e7e6eef7daddeacacdced4828682}
$png_img_value_3 = {89504e470d0a1a0a0000000d49484452000002e1000001c808020000006f69a3a60001000049444154789cec9d757c15c71680bf8dbb904020844082bb5bd0b6480b350a050a3cbcb8bbd352ac38c5a150a40285622d}
$png_img_value_4 = {89504e470d0a1a0a0000000d494844520000019d000000dc0806000000abac7cdf000000017352474200aece1ce90000000467414d410000b18f0bfc6105000000097048597300000ec300000ec301c76fa864000027}
$png_img_value_5 = {89504e470d0a1a0a0000000d49484452000001520000008f0806000000a80253aa000000017352474200aece1ce90000000467414d410000b18f0bfc6105000000097048597300000ec300000ec301c76fa864000000}
$png_img_value_6 = {89504e470d0a1a0a0000000d49484452000001ca000000d308020000008e50c46c000000017352474200aece1ce90000000467414d410000b18f0bfc61050000000970485973000012740000127401de661f7800002b}
Stage URL: hXXp://198[.]46.132.212/1118/vbc[.]exe
Stage Executable SHA256: 160ea3850bd5f084c27aeeebae4ae027419d9e16c0cfdfdd951ca4c7d4f64dd6
Unpacked Formbook Executable Name: bin.exe
Unpacked Formbook Executable SHA256: 99083c2f467368451fbc15b8fb5131916a8e788351a055d682c585574b5d9191