General

  • Target
    TNT AWB TRACKING DETAILS.exe
  • Size 245KB
  • Sample220125-rmt9nahbh8
  • SHA256 5f3980e6686fe4d2dc41f24e42287d082cc894a57078e69e4a9554bec20ff5cc
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • formbook

Version
  • 4.1

Campaign
  • a34b

Decoy
  • mesonarte.com

  • eksiwakun9.xyz

  • dustcollectionconsultant.com

  • heliosarchitecture.com

  • chinaanalysisgroup.com

  • nimbinhillshemp.com

  • ychain.biz

  • mountshastaart.com

  • monstermangoloco.com

  • bodhiandbear.com

  • rootednft.xyz

  • metayema.com

  • zw21.xyz

  • criccketworld.com

  • segurobarato.net

  • ananyacap.com

  • momo-momo.xyz

  • ezrealestatedeals.com

  • ghrde.xyz

  • idimol.com

Targets

    • Target
      TNT AWB TRACKING DETAILS.exe
    • Size 245KB
    • SHA256 5f3980e6686fe4d2dc41f24e42287d082cc894a57078e69e4a9554bec20ff5cc
    • MD5 SHA1 SHA512
    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook Payload

    • Deletes itself

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks