Overview

overview

10

Static

static

5

PI 347_DUH...df.exe

windows7-x64

10

PI 347_DUH...df.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    PI 347_DUHS_MRI.pdf.exe
  • Size 1.1MB
  • Sample240919-pnyx5ayblb
  • SHA256 18c262c08dce6a59267af49ac575ddd996ebd7b1d8bcfb31cff9f9f9814cfd91
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
formbookk94gdiscoveryratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • k94g

Decoy

  • nstandgoz.xyz

  • dhd-treatment-37310.bond

  • 13s-braces-us-ze.fun

  • umdona.shop

  • 96ph803ql.bond

  • kka9max.net

  • corporate-10.xyz

  • edicalassistance869840.online

  • lobalresources-bh.xyz

  • 3145978.xyz

  • ovdaawebsite.online

  • etting-thailand.net

  • icloud.xyz

  • poxk.shop

  • 25ks-ls72510.cyou

  • women.info

  • iwyrfbfvhv9.asia

  • luratu.xyz

  • ffordable-power-charger.today

  • edanuryilmaz.xyz

Targets

    • Target
      PI 347_DUHS_MRI.pdf.exe
    • Size 1.1MB
    • SHA256 18c262c08dce6a59267af49ac575ddd996ebd7b1d8bcfb31cff9f9f9814cfd91
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    formbookk94gdiscoveryratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks