General

  • Target

    DHL_TOC2_2407081728458457.pdf.z

  • Size

    576KB

  • Sample

    240716-mj4ayaxhrk

  • MD5

    f5b5b71ec7851ba536faed4767ddaa6d

  • SHA1

    a895b4e7d05f4eb421b0b4d1df58e02a419bd045

  • SHA256

    439cbde8712d39fa4b51f9e4c3a12e87f83f7e00bb2a263ca7be9686caefdd78

  • SHA512

    9cfbb69e16733f7f04576c47d6798d27359f291b7378d21fb4f14ec190021f618ddf92a08697b525ac17d2807826dc2bcd0702ec8022eda3ff11f0190293d959

  • SSDEEP

    12288:8Vn6o0zaz1IStJaOygIgdoD2J/hXuejAvSpD93/bZI:8V6+JIq4Oyzgu2ZhXurvsljZI

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

rn94

Decoy

st68v.xyz

conciergenotary.net

qwechaotk.top

rtpdonatoto29.xyz

8ad.xyz

powermove.top

cameras-30514.bond

vanguardcoffee.shop

umoe53fxc1bsujv.buzz

consultoriamax.net

hplxx.com

ndu.wtf

yzh478c.xyz

bigbrown999.site

xiake07.asia

resdai.xyz

the35678.shop

ba6rf.rest

ceo688.com

phimxhot.xyz

Targets

    • Target

      DHL_TOC2_2407081728458457.pdf.exe

    • Size

      1.0MB

    • MD5

      f6ed869b733b1f2aa3bdd06040f3372a

    • SHA1

      7075acf1c62e44653f5c834a14b56cd342f0ae5a

    • SHA256

      05b3ae9c167cf06edf52dc99127dfd516e24ead51e9da7d3fbf230124e7063e1

    • SHA512

      cba7753022eaa43f2d1bc77c73c7276824545e3083eee5e321f8be5b729bad3b01fe84108cbc5bdbe5fca7df1e802a55b36ef19292b1874a1cb514af5c16c582

    • SSDEEP

      24576:PAHnh+eWsN3skA4RV1Hom2KXMmHasscwkKNvvD5:yh+ZkldoPK8Yassht

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook payload

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks