General

  • Target

    DHL documents_PDF.exe

  • Size

    607KB

  • Sample

    240923-rf6n4s1hpf

  • MD5

    2cfcfa872943b645d06cfa942435d654

  • SHA1

    0055d197345b987a44eb5606b9de1f37266e02cc

  • SHA256

    a9ca3955156a843f095203a36d37f40d305926be366fbc1238e73e8590284655

  • SHA512

    50008d8a526146310aeb73ddb8f0d3e5b000dd3fc288109b640f9280e375ce1588640168bbea27a202060a8eaf1abb7e2c0c8d650a856c99ec0dcde8647364e3

  • SSDEEP

    12288:dd9NnRTwX/gNDTIO7LFV9B75Nrwu1oQZwq37crrjjnJZw:H5BvIi79B7t+q37SHJe

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

b31a

Decoy

enjamin-paaac.buzz

mail-marketing-40950.bond

pusems28-post.cyou

hindo.top

ruck-company-be.today

asinos-deutschland.net

ewancash.boats

etdopovo.casino

rcher-saaac.buzz

871166.vip

manuel.app

g3yqo.shop

-9way.xyz

qawgytfexe.bond

iefi6834.vip

ental-health-35901.bond

idat-merkez18.top

rojectleadzone.website

lirudolph.top

migloballlc.online

Targets

    • Target

      DHL documents_PDF.exe

    • Size

      607KB

    • MD5

      2cfcfa872943b645d06cfa942435d654

    • SHA1

      0055d197345b987a44eb5606b9de1f37266e02cc

    • SHA256

      a9ca3955156a843f095203a36d37f40d305926be366fbc1238e73e8590284655

    • SHA512

      50008d8a526146310aeb73ddb8f0d3e5b000dd3fc288109b640f9280e375ce1588640168bbea27a202060a8eaf1abb7e2c0c8d650a856c99ec0dcde8647364e3

    • SSDEEP

      12288:dd9NnRTwX/gNDTIO7LFV9B75Nrwu1oQZwq37crrjjnJZw:H5BvIi79B7t+q37SHJe

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook payload

    • Deletes itself

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks