Overview

overview

10

Static

static

DHL_AWB_NO...11.exe

windows7_x64

3

DHL_AWB_NO...11.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    DHL_AWB_NO#907853880911.exe
  • Size 652KB
  • Sample211202-ktb84adegp
  • SHA256 928fa5212b0c021cfc133bf17ce791b9a12f627356a171ae1afa377fdbb3ca19
  • MD5 SHA1 SHA512
Score
10/10
formbookfl9wratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • fl9w

C2

  • http://www.makheads.com/fl9w/

Decoy

  • alicebowtique.com

  • way2discounts.com

  • chihangjingmi.com

  • exmcap.com

  • artisquid.com

  • financelbs.com

  • tresholdnetwork.com

  • www-9367.com

  • funtripsouthindia.com

  • ibew-neca.com

  • elqaunim.com

  • gbetapi.com

  • turkthee.com

  • greaterdetroitrealtyexpert.com

  • springhousevet.com

  • dgjt1688.com

  • broomsweeping.com

  • bettyfred.xyz

  • afmcabnot6.xyz

  • toylandmetaverse.com

Targets

    • Target
      DHL_AWB_NO#907853880911.exe
    • Size 652KB
    • SHA256 928fa5212b0c021cfc133bf17ce791b9a12f627356a171ae1afa377fdbb3ca19
    • MD5 SHA1 SHA512
    Score
    10/10
    formbookfl9wratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks