Overview

overview

10

Static

static

Shipping.D...df.exe

windows7-x64

10

Shipping.D...df.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    Shipping.Document.Confirmation.pdf.exe
  • Size 994KB
  • Sample220908-gr1xwsdgg8
  • SHA256 c6d4469628973b42861dfd82d5bdb14d03cfe0ded1511db6a04964f72404b521
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
formbookoe47ratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • oe47

Decoy

  • amyrusscreative.com

  • spmactivos.com

  • mmdoh.store

  • giveupeasily.com

  • headline228164.biz

  • limitedessense.net

  • thetechylife.com

  • tonebeautyy.com

  • royebe.com

  • sogoodsong.com

  • damesindirestraits.com

  • petasoz.com

  • xvfunding.com

  • republicanvideoproduction.net

  • notiltrp.com

  • tassaraysaglikhizmetleri.com

  • youguetland.com

  • olfanees.com

  • sendmageemail.com

  • da-cap.net

Targets

    • Target
      Shipping.Document.Confirmation.pdf.exe
    • Size 994KB
    • SHA256 c6d4469628973b42861dfd82d5bdb14d03cfe0ded1511db6a04964f72404b521
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    formbookoe47ratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks