Overview

overview

10

Static

static

DHL Notifi...ff.exe

windows7-x64

10

DHL Notifi...ff.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    DHL Notification_pdff.exe
  • Size 974KB
  • Sample221014-gx614abcc4
  • SHA256 b9ec984e1e2aa9c2f6f73086d736e352ecbf40b05397093d4d2fc47aad51ff6b
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
formbookg2e8ratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • g2e8

Decoy

  • sawtiger.com

  • titanblackcat.buzz

  • caernarfontown.net

  • aladdin.coffee

  • we-buy-houses-cash.net

  • wfzctag.top

  • bluehouse.computer

  • hi88pro.online

  • smtfhcl.com

  • claimitznow.xyz

  • wnshots.store

  • ky3165.com

  • reviewforus.xyz

  • sportsandluxurycars.online

  • swchx.com

  • babnetwork.xyz

  • careplatform.online

  • ventilationbremen.com

  • templecause.shop

  • id-serportesepong345464.shop

Targets

    • Target
      DHL Notification_pdff.exe
    • Size 974KB
    • SHA256 b9ec984e1e2aa9c2f6f73086d736e352ecbf40b05397093d4d2fc47aad51ff6b
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    formbookg2e8ratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Deletes itself

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks