General

  • Target
    Additional DHL shipment Delivery Parcel.exe
  • Size 510KB
  • Sample210226-2tyh2pa522
  • SHA256 b5ac8902c4d239f5f72366876e99a586d3aaafe45c9a9e098c8ded9a2db7615c
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • formbook

C2
  • http://www.webperb.com/nehc/

Decoy
  • havenmaple.com

  • katrinasmarket.com

  • ccharlet.com

  • everestmedicalgroupusa.net

  • powervoc.com

  • crypto300cluv.com

  • davidrichterlaw.com

  • parkcitysongfest.com

  • videogeniusawards.com

  • beleave.club

  • gooddeedprocessing.com

  • synthsup.com

  • eceiptsworld.com

  • infinityanalytics.co.uk

  • damghair.com

  • sabaidate.com

  • guitarsir.com

  • thebowlingspot.com

  • denturelabmiami.com

  • mo-cooking.com

Targets

    • Target
      Additional DHL shipment Delivery Parcel.exe
    • Size 510KB
    • SHA256 b5ac8902c4d239f5f72366876e99a586d3aaafe45c9a9e098c8ded9a2db7615c
    • MD5 SHA1 SHA512
    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook Payload

    • Deletes itself

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks