SHARE
TWEET

2019-02-14 - Malspam uses Dropbox link to push Formbook

malware_traffic Feb 14th, 2019 2,344 Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. 2019-02-14 - MALSPAM USES DROPBOX LINK TO PUSH FORMBOOK
  2.  
  3. DESCRIPTION:
  4.  
  5. - Malicious spam (malspam) has Dropbox link to downloade .ace archive.  This .ace archive contains a Formbook malware executable disguised as a purchase order.
  6.  
  7. DOWNLOADED .ACE ARCHIVE:
  8.  
  9. - SHA256 hash: d8192e22d2dc8f8e5be12606b414ab69ba51495938d13272ad7004688621fd92
  10. - File size: 262,340 bytes
  11. - File name: PO order Feb14th.ace
  12. - File location: hxxps://www.dropbox[.]com/s/0pw2t4wv09bbe5l/PO%20order%20Feb14th.ace?dl=1
  13.  
  14. EXTRACTED FORMBOOK MALWARE:
  15.  
  16. - SHA256 hash: 8bbf02a94a780975379ba3b1d43acd0d0e99e7cf636a390b8aefa14ba0c6bf7a
  17. - File size: 569,344 bytes
  18. - File name: PO order Feb14th.exe
  19. - Any.Run analysis: https://app.any.run/tasks/310a1006-c000-4d0e-9213-32715c146a86
  20. - CAPE Sandbox: https://cape.contextis.com/analysis/37059/
  21. - Reverse.it: https://www.reverse.it/sample/8bbf02a94a780975379ba3b1d43acd0d0e99e7cf636a390b8aefa14ba0c6bf7a
  22.  
  23. ASSOCIATED EMAIL:
  24.  
  25. Received: from mana0.moldingboyforgood.com ([68.183.175.209]) by [removed] for [removed];
  26.         Thu, 14 Feb 2019 13:25:19 +0000 (UTC)
  27. DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; s=1550141161.moldingboyforgood;
  28.     d=moldingboyforgood.com; h=Reply-To:From:To:Subject:Date:Message-ID:MIME-Version:
  29.     Content-Type; i=contact@moldingboyforgood.com; bh=RvAy5qrGJrYUfPg8JSGrt6TEUEA=;
  30.     b=PyV3+QoIa+ssnO8CZwEfU5hDXQiUCJC9jKcXPlH3MuYg7bb3NjP2kf07osoQo8Iah9aKpE9YzQUY
  31.     iQ26dNxPSojL+ylSoEHEl2OERANKSifavaTlJgsrcpiTKliuyoMtqGpT38f5M0Z6ZDZD9FXNeJ/B
  32.     xoBwmBwbFb+/RlczUrw=
  33. DomainKey-Signature: a=rsa-sha1; c=nofws; q=dns; s=1550141161.moldingboyforgood;
  34.     d=moldingboyforgood.com; b=DSjxN6hBOUj08MO520bMhaudeYvr5eALOCy/Yb78dEA02
  35.     Aiay7xhENmsB+zsh9SfRsopQ8ATiu66c/WCbl4kn/ErBwpNDkA8fNeyu3JTepVjMvDB+Og0j
  36.     lkYS4U/A2LmoJapP3odKnOXRrchYjjPdB+/eFaqrpct2OIC4D1KpUg=;
  37. Date: 14 Feb 2019 05:24:50 -0800
  38. MIME-Version: 1.0
  39. Subject: SEND PROFORMA INVOICE FOR PAYMENT
  40. Message-ID: <20190214052450.D3577FC09F461160@moldingboyforgood.com>
  41. From: Alimbka CO <contact@moldingboyforgood.com>
  42. Content-Type: multipart/related;
  43.     boundary="----=_nextpart_000_0012_596469b6.98540f71"
  44. To: [removed]
  45. Reply-To: erdoganparteksltd@gmail.com
  46.  
  47. ------=_nextpart_000_0012_596469b6.98540f71
  48. Content-Transfer-Encoding: quoted-printable
  49. Content-Type: text/html;
  50.     charset="iso-8859-1
  51.  
  52. <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
  53.  
  54. <HTML><HEAD>
  55. <META name=GENERATOR content="MSHTML 11.00.9600.18639"></HEAD>
  56. <body style="MARGIN: 0.5em">
  57. <P>Dear Sir,</P>
  58. <P>We are glad to receive your mail as you know we have been on national holiday but we have resume for business now, base on your last mail before the holiday, we consider your price list workable for our market, find below attach Purchase order and send us proforma invoice for first payment.<BR>Await your soonest responds<BR>Best regards<BR>Alimbiko Co,<BR>Sauith suite 4889<BR>Swiss<BR><A href="hxxps://www.dropbox[.]com/s/0pw2t4wv09bbe5l/PO%20order%20Feb14th.ace?dl=1">
  59. <img src="cid:purcahseorder.png" width="182" height="127"></A></P>
  60. <P>&nbsp;</P></BODY></HTML>
  61.  
  62. ------=_nextpart_000_0012_596469b6.98540f71
  63. Content-Transfer-Encoding: base64
  64. Content-Type: image/png; name="purcahseorder.png"
  65. Content-Id: <purcahseorder.png>"
  66.  
  67. [information removed]
  68.  
  69. ------=_nextpart_000_0012_596469b6.98540f71--
RAW Paste Data
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy. OK, I Understand
 
Top