General
-
Target
13012021.exe
-
Size
1.0MB
-
Sample
210113-hyn52828dn
-
MD5
5a3dfc0ef78aab90422df535e97cbe9c
-
SHA1
37a8d89122bd0555e3a83e4940ff1871892f55f6
-
SHA256
ae73e8799690e6e7efe2222fe8a471af2c7f7f0f82dff259434626eac35a2721
-
SHA512
63713d49cb4c3d1cadf05be96bfb6c1e9152b999a99ce9567c634d382e45885ade8acc0aaae3771a4396038337e1f31d2d3a50214bebc452e2e21f9010540c9e
Malware Config
Extracted
formbook
http://www.timoniks.com/rbg/
fingermode.com
parkplace.finance
hollandgreen2020.com
starbets.site
vehiculesfrigorifiques.com
sydiifinancial.com
rpivuenation.com
freesubdirectory.com
independencepartynyc.com
dogruparti.info
independencecountyclub.com
midnightlashesbykim.com
digitalsept.com
whatilikeabouttoday.com
marktplaatsaccount.info
13400667334.com
xinwei-ge.com
login-appleid.info
momashands.com
kennyxpress.com
Targets
-
-
Target
13012021.exe
-
Size
1.0MB
-
MD5
5a3dfc0ef78aab90422df535e97cbe9c
-
SHA1
37a8d89122bd0555e3a83e4940ff1871892f55f6
-
SHA256
ae73e8799690e6e7efe2222fe8a471af2c7f7f0f82dff259434626eac35a2721
-
SHA512
63713d49cb4c3d1cadf05be96bfb6c1e9152b999a99ce9567c634d382e45885ade8acc0aaae3771a4396038337e1f31d2d3a50214bebc452e2e21f9010540c9e
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Formbook Payload
-
Deletes itself
-
Suspicious use of SetThreadContext
-