Overview

overview

10

Static

static

DHL - WAYB...os.exe

windows7_x64

10

DHL - WAYB...os.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    DHL - WAYBILL 44 7611 9546 - Joao Carlos.exe
  • Size 398KB
  • Sample211124-w9gz3agff3
  • SHA256 79d3e390f7d102dfb3dd6840d95a54fe2dd26a5f90ab8d040be7024e6f9d53fc
  • MD5 SHA1 SHA512
Score
10/10
formbookig34ratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • ig34

C2

  • http://www.priorlakeheatingandcooling.com/ig34/

Decoy

  • zeoment.com

  • delarituel.com

  • wistechonline.com

  • bluereaper.net

  • swooshlite.com

  • naguala.com

  • linked4me.site

  • pichiwedding.com

  • urvmj9.cloud

  • blackandaya.com

  • bizcentral.tech

  • quash-this.com

  • iaione.com

  • viewarea.store

  • kdrczbm.xyz

  • scijochem.net

  • steamcommunilly.online

  • ablegreat.com

  • olivetreesmart.com

  • burningtoys.com

Targets

    • Target
      DHL - WAYBILL 44 7611 9546 - Joao Carlos.exe
    • Size 398KB
    • SHA256 79d3e390f7d102dfb3dd6840d95a54fe2dd26a5f90ab8d040be7024e6f9d53fc
    • MD5 SHA1 SHA512
    Score
    10/10
    formbookig34ratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook Payload

      rat

    • Deletes itself

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks