General
-
Target
c6f311ade929a6fe981c315577d408b1.exe
-
Size
875KB
-
Sample
210112-2d1m57eaga
-
MD5
c6f311ade929a6fe981c315577d408b1
-
SHA1
c6a7df0141cba6c22f35664e0c7139cb4fe703d1
-
SHA256
c689182f2eb4ca29f372d9c51d15ac878f7cb6a5b0abf6b83a6e53abb5279c95
-
SHA512
980d61eb5bf69b1557539437fb400f1648bcb11f7e865122fc2a1b908bac31d4f0290bdd639cb4e76f77dde6e85509f5e69a07faa07f71643aab33f12898b9b1
Malware Config
Extracted
formbook
http://www.theatomicshots.com/xle/
tknbr.com
loyaloneconstruction.com
what-where.com
matebacapital.com
marriedandmore.com
qiemfsolutions.com
graececonsulting.com
www7456.com
littlefreecherokeelibrary.com
tailgatepawkinglot.com
musheet.com
tesfamariamtb.com
1728025.com
xceltechuae.com
harperandchloe.com
thepamperedbarber.com
5050alberta.com
supplychainstrainer.com
lacorte.group
ringingbear.com
Targets
-
-
Target
c6f311ade929a6fe981c315577d408b1.exe
-
Size
875KB
-
MD5
c6f311ade929a6fe981c315577d408b1
-
SHA1
c6a7df0141cba6c22f35664e0c7139cb4fe703d1
-
SHA256
c689182f2eb4ca29f372d9c51d15ac878f7cb6a5b0abf6b83a6e53abb5279c95
-
SHA512
980d61eb5bf69b1557539437fb400f1648bcb11f7e865122fc2a1b908bac31d4f0290bdd639cb4e76f77dde6e85509f5e69a07faa07f71643aab33f12898b9b1
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Formbook Payload
-
Suspicious use of SetThreadContext
-