Overview

overview

10

Static

static

1

SHIPPING D...TS.exe

windows7_x64

10

SHIPPING D...TS.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    SHIPPING DOCUMENTS.exe
  • Size 388KB
  • Sample210330-b3epe495e2
  • SHA256 8ac1fc19367861f3a749d801300f554148e36a0e8a4f4cce3c5d3e4de43e4279
  • MD5 SHA1 SHA512
Score
10/10
formbookratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

C2

  • http://www.middlehambooks.com/klf/

Decoy

  • podcastyourvote.com

  • northernlsx.com

  • guide4idiots.com

  • artebythesea.com

  • sapanyc.com

  • livinoutthedreamsco.com

  • thepowersinyou.com

  • protocolmodern.com

  • holdergear.com

  • betteringthehumanexperience.xyz

  • agnostec.com

  • royermaldonado.com

  • wealthtruckingco.com

  • artcode-software.com

  • microsoftpods.com

  • identityofplace.com

  • algoritas.com

  • grandpaurbanfarm.net

  • zahidibr.com

  • flawlessdrinking.com

Targets

    • Target
      SHIPPING DOCUMENTS.exe
    • Size 388KB
    • SHA256 8ac1fc19367861f3a749d801300f554148e36a0e8a4f4cce3c5d3e4de43e4279
    • MD5 SHA1 SHA512
    Score
    10/10
    formbookratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook Payload

      rat

    • Deletes itself

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks