Overview

overview

10

Static

static

Shipping Docs_pdf.exe

windows7_x64

10

Shipping Docs_pdf.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Shipping Docs_pdf.exe

  • Size

    1.4MB

  • Sample

    210119-6fw2gjht12

  • MD5

    6bcd66deb9a6bddfa3f2329cde1b6126

  • SHA1

    e2414d88355d9d1f37c77d1562f1f1c8a2716880

  • SHA256

    f3ddc95f31cacb29b7ec70b8dd6f0fb5befb759f7044e491b269417e91037d1d

  • SHA512

    731921ac4210c5a4f0227bb4637f9fa525b9f56b88e00bc13fbe4a15579dcd7c762e3d29e6076e3157ba04f9ca9830da2000dc2134e1da8ff44f93bb5b35eb88

Score
10/10
formbookratspywarestealertrojan

Malware Config

Extracted

Family

formbook

C2

http://www.huynhanhdung.com/kna/

Decoy

lawrencefiredepartment.com

executivehomeoffices.com

solfed.world

oshawaexchange.com

webdavlexstore.com

youpieb.com

chiller-master.com

bearstoragetn.com

daf90x16.com

gewhacaalouine.com

simplyezi.com

cstechnologyservices.com

nosyboats.com

thecocomarie.com

vetinaryeco.club

americangoselfilm.com

gdsuhejia.com

verbunden-sein.net

the-minerva.com

loctrantv.com

Targets

    • Target

      Shipping Docs_pdf.exe

    • Size

      1.4MB

    • MD5

      6bcd66deb9a6bddfa3f2329cde1b6126

    • SHA1

      e2414d88355d9d1f37c77d1562f1f1c8a2716880

    • SHA256

      f3ddc95f31cacb29b7ec70b8dd6f0fb5befb759f7044e491b269417e91037d1d

    • SHA512

      731921ac4210c5a4f0227bb4637f9fa525b9f56b88e00bc13fbe4a15579dcd7c762e3d29e6076e3157ba04f9ca9830da2000dc2134e1da8ff44f93bb5b35eb88

    Score
    10/10
    formbookratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook Payload

      rat

    • Deletes itself

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks