Overview

overview

10

Static

static

DHL Consig...df.exe

windows7-x64

10

DHL Consig...df.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    DHL Consignment Details_pdf.exe
  • Size 1.0MB
  • Sample221210-ksqebsfc32
  • SHA256 4167987df2a1b3583bc8cf5a97fb1cebf68ccbc9a627e8b5c156d30413ebb139
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
formbookg28pratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • g28p

Decoy

  • whhmgs.asia

  • wellmedcaredirect.net

  • beggarded.com

  • wtpjiv.site

  • todo-celulares.com

  • parkitny.net

  • 43345.top

  • pro-genie.com

  • cwdxz.com

  • cbc-inc.xyz

  • healthspots.net

  • rulil.top

  • pyramidaudit.solutions

  • k8sb15.live

  • hempaware.report

  • usclink.life

  • stayefs.net

  • 05262.top

  • shop-izakaya-jin.com

  • iccworldcupnews.com

Targets

    • Target
      DHL Consignment Details_pdf.exe
    • Size 1.0MB
    • SHA256 4167987df2a1b3583bc8cf5a97fb1cebf68ccbc9a627e8b5c156d30413ebb139
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    formbookg28pratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Deletes itself

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks