Overview

overview

10

Static

static

DHL_AWB_NO...11.exe

windows7-x64

10

DHL_AWB_NO...11.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    DHL_AWB_NO#907853880911.exe
  • Size 673KB
  • Sample220801-g4wtpseedl
  • SHA256 8cfab7564a09852f6ac15b97c02e63ea07b6099f6d38d39c05b06c8e097e6d31
  • MD5 SHA1 SHA512
Score
10/10
formbooks0s2ratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • s0s2

Decoy

  • stripe-forecast.com

  • perfectingnextstage.com

  • primarole.com

  • nonnydesigns.com

  • wordsofweightandlevity.com

  • mafleursam.com

  • hardwarepicker.tech

  • minex-intl.com

  • thenextbigtech.net

  • rabeproject.com

  • sticktogracestudio.com

  • releve.space

  • readoku.net

  • carings.net

  • nasdaq-ex.store

  • au-techng.com

  • thethoughtgenius.com

  • how-to-learn-languages.net

  • kitabisabelanja.com

  • awndka.xyz

Targets

    • Target
      DHL_AWB_NO#907853880911.exe
    • Size 673KB
    • SHA256 8cfab7564a09852f6ac15b97c02e63ea07b6099f6d38d39c05b06c8e097e6d31
    • MD5 SHA1 SHA512
    Score
    10/10
    formbooks0s2ratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Deletes itself

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks