General

  • Target

    FedexAwbDetailspdf.exe

  • Size

    575KB

  • Sample

    240923-ehr8aawbpm

  • MD5

    7bb7c27ef2c8fa595336641682216af1

  • SHA1

    f3005e0e792af7ee0121dea5c4eac5e9c4a14935

  • SHA256

    3d7f6d2750179e8e650d7a689b3271955aadc23e58c2fd6d43077a313ff8707b

  • SHA512

    306d5acc71ce7f2be174464cb7541cede89e0eb46c09e146fa88d2fa5dbd6d5b7bbb7c4bcc8fe67d609f33bab9fdb72049fcabba2dbe3b48377a95472a6acd26

  • SSDEEP

    12288:D/vEqjqYBVySejHOr8uEc/F/4dAl88iTdjB+b55rSN6il:D0pU/3r8hch4dQiT7YZSUi

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

b31a

Decoy

enjamin-paaac.buzz

mail-marketing-40950.bond

pusems28-post.cyou

hindo.top

ruck-company-be.today

asinos-deutschland.net

ewancash.boats

etdopovo.casino

rcher-saaac.buzz

871166.vip

manuel.app

g3yqo.shop

-9way.xyz

qawgytfexe.bond

iefi6834.vip

ental-health-35901.bond

idat-merkez18.top

rojectleadzone.website

lirudolph.top

migloballlc.online

Targets

    • Target

      FedexAwbDetailspdf.exe

    • Size

      575KB

    • MD5

      7bb7c27ef2c8fa595336641682216af1

    • SHA1

      f3005e0e792af7ee0121dea5c4eac5e9c4a14935

    • SHA256

      3d7f6d2750179e8e650d7a689b3271955aadc23e58c2fd6d43077a313ff8707b

    • SHA512

      306d5acc71ce7f2be174464cb7541cede89e0eb46c09e146fa88d2fa5dbd6d5b7bbb7c4bcc8fe67d609f33bab9fdb72049fcabba2dbe3b48377a95472a6acd26

    • SSDEEP

      12288:D/vEqjqYBVySejHOr8uEc/F/4dAl88iTdjB+b55rSN6il:D0pU/3r8hch4dQiT7YZSUi

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook payload

    • Deletes itself

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks