Overview

overview

10

Static

static

5

TNT AWB TR...IL.exe

windows7-x64

10

TNT AWB TR...IL.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    808d60c29c337aea37014a94d88be5b7c297cd814c7c9ae322396d51ae1d97ce
  • Size 791KB
  • Sample240925-e3n2csybke
  • SHA256 808d60c29c337aea37014a94d88be5b7c297cd814c7c9ae322396d51ae1d97ce
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
formbookjd21discoveryratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • jd21

Decoy

  • bankownedproperties-0.bond

  • slab-leak-repair-74697.bond

  • tvtwenty20sr.top

  • scw-iot.net

  • circusenergy.online

  • 030002787.xyz

  • propertiesforrentus11.bond

  • defi-banksystem.online

  • gkbet168.net

  • joycasino-ed46.top

  • sctttc-or.top

  • borghardt.xyz

  • therealtorpeddler.info

  • macexpress.online

  • bobbyharvey.store

  • dating-dd-de.info

  • thetrue.one

  • alqahtani.site

  • mahlubini.africa

  • truck-driver-jobs-42274.bond

Targets

    • Target
      TNT AWB TRACKING DETAIL.exe
    • Size 1.1MB
    • SHA256 9de1654530e9c6e5e1d5054bc17d04c2aa08a35b8e1285d86c2cb34ec8b0f3a5
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    formbookjd21discoveryratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks