Overview

overview

10

Static

static

DATASHEET-...93.rtf

windows7-x64

10

DATASHEET-...93.rtf

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    DATASHEET- PR no. 8471101093.doc

  • Size

    3KB

  • Sample

    221210-krlprafc23

  • MD5

    67a2cd30fcf4184b1515ba628b1e5710

  • SHA1

    c9fb5d6a4d412336df170c355aad3721f40c284f

  • SHA256

    673af81ba4d91c2aaa5a445a7399b8985a7144b58945e776470b32e059cbbcc4

  • SHA512

    936b51f5f0c3d900903041b4261821c2a5ad1d15cb0bc43954451a19d7e789f06fd449f4f960aed5fbf98e6fdbbff40434e15b01bede4255c32f209d1f9ac3dc

Score
10/10
formbookh3haratspywarestealertrojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

h3ha

Decoy

ideas-dulces.store

store1995.store

swuhn.com

ninideal.com

musiqhaus.com

quranchart.com

kszq26.club

lightfx.online

thetickettruth.com

meritloancubk.com

lawnforcement.com

sogeanetwork.com

thedinoexotics.com

kojima-ah.net

gr-myab3z.xyz

platiniuminestor.net

reviewsiske.com

stessil-lifestyle.com

goodqjourney.biz

cirimpianti.com

Targets

    • Target

      DATASHEET- PR no. 8471101093.doc

    • Size

      3KB

    • MD5

      67a2cd30fcf4184b1515ba628b1e5710

    • SHA1

      c9fb5d6a4d412336df170c355aad3721f40c284f

    • SHA256

      673af81ba4d91c2aaa5a445a7399b8985a7144b58945e776470b32e059cbbcc4

    • SHA512

      936b51f5f0c3d900903041b4261821c2a5ad1d15cb0bc43954451a19d7e789f06fd449f4f960aed5fbf98e6fdbbff40434e15b01bede4255c32f209d1f9ac3dc

    Score
    10/10
    formbookh3haratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks