Overview

overview

10

Static

static

Mv Maersk ...df.exe

windows7_x64

10

Mv Maersk ...df.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Mv Maersk Kleven V949E_pdf.exe

  • Size

    958KB

  • Sample

    210115-p2472421sj

  • MD5

    b86abf15be6a1c7027e7a89ea3d821ca

  • SHA1

    3b1bc94e7565aaf7cbe293dba32fca871ecf704d

  • SHA256

    a078d966a3ac5a7ac639b01ba4d3230c7554d7d75e9e7f59dc35b623aec8dbda

  • SHA512

    45447d8f3f87f76f5813698ed08b55c72de283ba367382a73599dcc27773e82ee9ff4e9edc339c0a74fc5e1dae998d6f16e125a7ad6fd9824d0bc72d7d5d4419

Score
10/10
formbookratspywarestealertrojan

Malware Config

Extracted

Family

formbook

C2

http://www.embracingmyjourney.net/p7t/

Decoy

crosvudigital.com

airgreenllc.com

epochryphal.com

handy-domain-listing.com

espaceideecreation.com

3sleeves.com

alotrooms.com

luttelion.com

efekaleci.xyz

allpapas.com

alverazricardez.com

meghandoria.com

deicorp-community.com

877nz.com

bahmanhochmetalwerks.com

teppeisugaya.com

kitrablog.digital

theatermoviebuying.com

ptlycloudy.com

ablehed.pro

Targets

    • Target

      Mv Maersk Kleven V949E_pdf.exe

    • Size

      958KB

    • MD5

      b86abf15be6a1c7027e7a89ea3d821ca

    • SHA1

      3b1bc94e7565aaf7cbe293dba32fca871ecf704d

    • SHA256

      a078d966a3ac5a7ac639b01ba4d3230c7554d7d75e9e7f59dc35b623aec8dbda

    • SHA512

      45447d8f3f87f76f5813698ed08b55c72de283ba367382a73599dcc27773e82ee9ff4e9edc339c0a74fc5e1dae998d6f16e125a7ad6fd9824d0bc72d7d5d4419

    Score
    10/10
    formbookratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook Payload

      rat

    • Deletes itself

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks