General
-
Target
41e1b66a7d9ba85d2edb67eb3adf1ba8dd251ded73925d82f98bfdda5b34511b
-
Size
300KB
-
Sample
201203-llwa6y71jn
-
MD5
fd8cd7d2e66f83b52c4a5f23e8eb5c40
-
SHA1
ba16c9148e6ee8e70962eb60d629a28902befe74
-
SHA256
41e1b66a7d9ba85d2edb67eb3adf1ba8dd251ded73925d82f98bfdda5b34511b
-
SHA512
6ef5c4aa2b9cdc80089ab8f188e9744aa65c27dd539bb1c2c55e89b24e9f17d29c8b4fad803ac444ce3300aa547fc93c8aa42155a038ebc64caeb84f1a0f4b14
Malware Config
Extracted
formbook
http://www.joomlas123.com/m92q/
marychrisantonettenina.com
orozcosantillanabogados.com
nikeairmax-shop.com
sugarride.com
bobevanseggs.com
everyremedy.com
taascoin.com
curve-arch.com
seowebdirectory.biz
airplanes.international
hrzwum.info
sjqaf.com
mjhcommunications.com
kobigrinberg.com
hhh573.com
elite-titleagency.com
onitsukasally.info
onosouvenir.com
tianyezhushu.com
taizhoutongyuan.com
Targets
-
-
Target
41e1b66a7d9ba85d2edb67eb3adf1ba8dd251ded73925d82f98bfdda5b34511b
-
Size
300KB
-
MD5
fd8cd7d2e66f83b52c4a5f23e8eb5c40
-
SHA1
ba16c9148e6ee8e70962eb60d629a28902befe74
-
SHA256
41e1b66a7d9ba85d2edb67eb3adf1ba8dd251ded73925d82f98bfdda5b34511b
-
SHA512
6ef5c4aa2b9cdc80089ab8f188e9744aa65c27dd539bb1c2c55e89b24e9f17d29c8b4fad803ac444ce3300aa547fc93c8aa42155a038ebc64caeb84f1a0f4b14
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Formbook Payload
-
rezer0
Detects ReZer0, a packer with multiple versions used in various campaigns.
-
Suspicious use of SetThreadContext
-