General

  • Target

    DHL Consignment Details_pdf.exe

  • Size

    933KB

  • Sample

    221208-m45phacg3w

  • MD5

    aab1518e80d1e2ae3415ffcd2cedee87

  • SHA1

    6be8247d09abdb0c5567e2d23f8850c531f60a04

  • SHA256

    9e308c465f428be79179482a5f233ac50211cfb39deb493d9a3a5143d13acda7

  • SHA512

    2d13b9e13c6e30515eaadc138b44865db3888144332dd96e544fb1e0e80beb8319fc5e7f1c864a3e356e991f2d89095186074c13ba8551dee41dadf5046b48f4

  • SSDEEP

    12288:t/cr2iNrq/vvvGn9Uy6mZUeV7llAsG7qgxxRUsAgOL5YKeshB+LByqzNMP1gURVN:2r1w09Uy6FSPdG7qw7U1hB+LBI

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

s20g

Decoy

coconutdap.com

pukka-party.co.uk

apexrp.dev

boostmycredit.info

bipobofficial.com

bjl009.com

kagoshimum.com

crtinha.xyz

longsteephill.co.uk

forfour4.com

adversata.com

lesaek.ru

chafang3.xyz

haungo.net

mynextgen.africa

credit-cards-45560.com

cnc-printing.com

antoniafredrik.se

likemedclinic.ru

gyeakoncert.com

Targets

    • Target

      DHL Consignment Details_pdf.exe

    • Size

      933KB

    • MD5

      aab1518e80d1e2ae3415ffcd2cedee87

    • SHA1

      6be8247d09abdb0c5567e2d23f8850c531f60a04

    • SHA256

      9e308c465f428be79179482a5f233ac50211cfb39deb493d9a3a5143d13acda7

    • SHA512

      2d13b9e13c6e30515eaadc138b44865db3888144332dd96e544fb1e0e80beb8319fc5e7f1c864a3e356e991f2d89095186074c13ba8551dee41dadf5046b48f4

    • SSDEEP

      12288:t/cr2iNrq/vvvGn9Uy6mZUeV7llAsG7qgxxRUsAgOL5YKeshB+LByqzNMP1gURVN:2r1w09Uy6FSPdG7qw7U1hB+LBI

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook payload

    • Deletes itself

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks