Overview

overview

10

Static

static

PO.doc

windows7_x64

10

PO.doc

windows10_x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target
    PO.doc
  • Size 19KB
  • Sample210928-ws7jdscfdk
  • SHA256 2dfd64c86cfb81ed8a280b74e6e7b244a8a98d3788c8c552266ddd5327e4f055
  • MD5 SHA1 SHA512
Score
10/10
formbookif60ratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • if60

C2

  • http://www.handelsbetriebposavec.com/if60/

Decoy

  • babyjames.space

  • dtjug.com

  • bhagteri.com

  • havplan.com

  • gentlesuccess.net

  • negativeminus.com

  • utesm.com

  • ngomen.online

  • abohemianeducation.com

  • hyper-quote.com

  • poseidonflooring.com

  • theshopdental.com

  • consumelocaloficial.com

  • tineue.com

  • traerpolio.com

  • somnambulantfarms.com

  • sugarhillclassiccars.com

  • brasseriedufayard.com

  • replacerglass.net

  • lazyguysmarketing.com

Targets

    • Target
      PO.doc
    • Size 19KB
    • SHA256 2dfd64c86cfb81ed8a280b74e6e7b244a8a98d3788c8c552266ddd5327e4f055
    • MD5 SHA1 SHA512
    Score
    10/10
    formbookif60ratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook Payload

      rat

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks