General

  • Target

    Mv Maersk Kleven V949E_pdf.exe

  • Size

    850KB

  • Sample

    210114-hm7q2j6cjj

  • MD5

    b9df17359c7c49389acb9d374464a780

  • SHA1

    0edbf3c732a2afb16be8041e6a45133449b186eb

  • SHA256

    56db76250b06a9b52b44a9cc88161cd8fb070c4b72aae4f2186362875edac275

  • SHA512

    9c394b2d1e4973338686124ad48851571682cd0cd38f67e067498492c43ec60a8f839729bf88a62bc7b3b66c7f103776789ca7516b1fc5fc5c9cd980d26da27d

Malware Config

Extracted

Family

formbook

C2

http://www.embracingmyjourney.net/p7t/

Decoy

crosvudigital.com

airgreenllc.com

epochryphal.com

handy-domain-listing.com

espaceideecreation.com

3sleeves.com

alotrooms.com

luttelion.com

efekaleci.xyz

allpapas.com

alverazricardez.com

meghandoria.com

deicorp-community.com

877nz.com

bahmanhochmetalwerks.com

teppeisugaya.com

kitrablog.digital

theatermoviebuying.com

ptlycloudy.com

ablehed.pro

Targets

    • Target

      Mv Maersk Kleven V949E_pdf.exe

    • Size

      850KB

    • MD5

      b9df17359c7c49389acb9d374464a780

    • SHA1

      0edbf3c732a2afb16be8041e6a45133449b186eb

    • SHA256

      56db76250b06a9b52b44a9cc88161cd8fb070c4b72aae4f2186362875edac275

    • SHA512

      9c394b2d1e4973338686124ad48851571682cd0cd38f67e067498492c43ec60a8f839729bf88a62bc7b3b66c7f103776789ca7516b1fc5fc5c9cd980d26da27d

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook Payload

    • Deletes itself

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks