General
-
Target
4b39f9fd4012f4534fb70bb2c2bfc7d9.exe
-
Size
756KB
-
Sample
210112-bxj8y4x7e2
-
MD5
4b39f9fd4012f4534fb70bb2c2bfc7d9
-
SHA1
65c948abd3024817e30ac66acb9e60ba379da3a3
-
SHA256
20eb20f9b9fa4186e31943fb30235c77fd0816a5e6b6fc1ac2a9144b46672e3d
-
SHA512
70f3582553390d2c21c032ecbbc7c196f2edb0165005de65e91dc738bcf9f0a257745b42510b9569ed5a77f1ed8e7cc349c3747e695996fbcac0b079c34cc972
Malware Config
Extracted
formbook
http://www.theatomicshots.com/xle/
tknbr.com
loyaloneconstruction.com
what-where.com
matebacapital.com
marriedandmore.com
qiemfsolutions.com
graececonsulting.com
www7456.com
littlefreecherokeelibrary.com
tailgatepawkinglot.com
musheet.com
tesfamariamtb.com
1728025.com
xceltechuae.com
harperandchloe.com
thepamperedbarber.com
5050alberta.com
supplychainstrainer.com
lacorte.group
ringingbear.com
Targets
-
-
Target
4b39f9fd4012f4534fb70bb2c2bfc7d9.exe
-
Size
756KB
-
MD5
4b39f9fd4012f4534fb70bb2c2bfc7d9
-
SHA1
65c948abd3024817e30ac66acb9e60ba379da3a3
-
SHA256
20eb20f9b9fa4186e31943fb30235c77fd0816a5e6b6fc1ac2a9144b46672e3d
-
SHA512
70f3582553390d2c21c032ecbbc7c196f2edb0165005de65e91dc738bcf9f0a257745b42510b9569ed5a77f1ed8e7cc349c3747e695996fbcac0b079c34cc972
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Formbook Payload
-
Suspicious use of SetThreadContext
-