Overview

overview

10

Static

static

DHL Consig...df.exe

windows7-x64

10

DHL Consig...df.exe

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    DHL Consignment Details_pdf.exe

  • Size

    1.0MB

  • Sample

    221210-ktj9psfc36

  • MD5

    a3f9e308045c0becd406e09bc06acc08

  • SHA1

    5d8df88d170f59ebe6ebbe3c816406cda30a64f7

  • SHA256

    4167987df2a1b3583bc8cf5a97fb1cebf68ccbc9a627e8b5c156d30413ebb139

  • SHA512

    375c7cf2c03841eb7bc9113da6294e9a05a4a65c88b77e0f9f1d5161e84814ed6302b0a42f3882c339e149fb4cc94803b39f114780fbbc8ec238d9130e09976f

  • SSDEEP

    24576:rhfC0AD3BXx4qpgqNzB/eV6meR+K1VQljpDpF07:EnBXx4oJBWV6meAEQZpm

Score
10/10
formbookg28pratspywarestealertrojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

g28p

Decoy

whhmgs.asia

wellmedcaredirect.net

beggarded.com

wtpjiv.site

todo-celulares.com

parkitny.net

43345.top

pro-genie.com

cwdxz.com

cbc-inc.xyz

healthspots.net

rulil.top

pyramidaudit.solutions

k8sb15.live

hempaware.report

usclink.life

stayefs.net

05262.top

shop-izakaya-jin.com

iccworldcupnews.com

Targets

    • Target

      DHL Consignment Details_pdf.exe

    • Size

      1.0MB

    • MD5

      a3f9e308045c0becd406e09bc06acc08

    • SHA1

      5d8df88d170f59ebe6ebbe3c816406cda30a64f7

    • SHA256

      4167987df2a1b3583bc8cf5a97fb1cebf68ccbc9a627e8b5c156d30413ebb139

    • SHA512

      375c7cf2c03841eb7bc9113da6294e9a05a4a65c88b77e0f9f1d5161e84814ed6302b0a42f3882c339e149fb4cc94803b39f114780fbbc8ec238d9130e09976f

    • SSDEEP

      24576:rhfC0AD3BXx4qpgqNzB/eV6meR+K1VQljpDpF07:EnBXx4oJBWV6meAEQZpm

    Score
    10/10
    formbookg28pratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Deletes itself

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks