General
-
Target
tmgF4oswp3fH2HU.exe
-
Size
641KB
-
Sample
240428-lcgmxscg5w
-
MD5
c7e9150cc6ae77c5bbd9be7b502a7359
-
SHA1
a949ff75e683ec0a7f2126a8f1df543139c6f46a
-
SHA256
13e8e9cf97e4d1357797ef4253db3c784ef8dbf39725214f1b174991c0e1ae4d
-
SHA512
15ab9394a983d59ccf959b5a831aa0497083f27e6355522f9a802959fc8f454d759dc12e8a8d002403540ca6bd4e1d8df387490fb0e15f895321fccd09f14331
-
SSDEEP
12288:JNgLeFR635lv312Z3jvtbxmJRll6MuVkC2GGEiHB781c/Ih8DTo92lMnO+qBtLuO:o5J312ZL52ZuV1jjiHq1c/Ih8XlMnmP
Malware Config
Extracted
formbook
4.1
be03
458q14v4ams2.com
priceoctopus.com
betinplay.xyz
bcnd.xyz
1510soliveavenue.com
mcdpropertypros.com
reddcrownexpress.com
rewardlabs.shop
burenbrand.com
revand.io
tractionendurancecoaching.com
jotaerreshopp.com
shopboyg.com
dakor.shop
groundswellmag.life
nehagadodia.com
dancarellibizbroker.com
meconline.co
ttmq.cc
thegoldenyouph.com
Targets
-
-
Target
tmgF4oswp3fH2HU.exe
-
Size
641KB
-
MD5
c7e9150cc6ae77c5bbd9be7b502a7359
-
SHA1
a949ff75e683ec0a7f2126a8f1df543139c6f46a
-
SHA256
13e8e9cf97e4d1357797ef4253db3c784ef8dbf39725214f1b174991c0e1ae4d
-
SHA512
15ab9394a983d59ccf959b5a831aa0497083f27e6355522f9a802959fc8f454d759dc12e8a8d002403540ca6bd4e1d8df387490fb0e15f895321fccd09f14331
-
SSDEEP
12288:JNgLeFR635lv312Z3jvtbxmJRll6MuVkC2GGEiHB781c/Ih8DTo92lMnO+qBtLuO:o5J312ZL52ZuV1jjiHq1c/Ih8XlMnmP
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Formbook payload
-
Deletes itself
-
Suspicious use of SetThreadContext
-