Overview

overview

10

Static

static

Mv Maersk ...df.exe

windows7_x64

10

Mv Maersk ...df.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Mv Maersk Kleven V949E_pdf.exe

  • Size

    847KB

  • Sample

    210114-hqmkxblkhj

  • MD5

    e47c0ab9cf929abce76d77ae7d634095

  • SHA1

    868807c4265bdfb8160cc9c7b062b8208a5ef93d

  • SHA256

    c94c6548dd723a5b6aac345f8aae65d4d8c6e86c3e86195c32616ab5dfa8cba9

  • SHA512

    fec7ea0143d2bb6c1a4003bbea1dffa1ef3e7458f3d9621d480a65c0fe1a651a150058052d69125cf77e76a7fd082930a7639a5fca4d171285c1e22ee422195d

Score
10/10
formbookratspywarestealertrojan

Malware Config

Extracted

Family

formbook

C2

http://www.embracingmyjourney.net/p7t/

Decoy

crosvudigital.com

airgreenllc.com

epochryphal.com

handy-domain-listing.com

espaceideecreation.com

3sleeves.com

alotrooms.com

luttelion.com

efekaleci.xyz

allpapas.com

alverazricardez.com

meghandoria.com

deicorp-community.com

877nz.com

bahmanhochmetalwerks.com

teppeisugaya.com

kitrablog.digital

theatermoviebuying.com

ptlycloudy.com

ablehed.pro

Targets

    • Target

      Mv Maersk Kleven V949E_pdf.exe

    • Size

      847KB

    • MD5

      e47c0ab9cf929abce76d77ae7d634095

    • SHA1

      868807c4265bdfb8160cc9c7b062b8208a5ef93d

    • SHA256

      c94c6548dd723a5b6aac345f8aae65d4d8c6e86c3e86195c32616ab5dfa8cba9

    • SHA512

      fec7ea0143d2bb6c1a4003bbea1dffa1ef3e7458f3d9621d480a65c0fe1a651a150058052d69125cf77e76a7fd082930a7639a5fca4d171285c1e22ee422195d

    Score
    10/10
    formbookratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook Payload

      rat

    • Deletes itself

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks