General
-
Target
d97a26894ec19dc562eec833ccb5607f.exe
-
Size
1.0MB
-
Sample
210113-pez6ktb96j
-
MD5
d97a26894ec19dc562eec833ccb5607f
-
SHA1
5aa0632c496d7e1441eef50c61c6a97c5adee565
-
SHA256
2fdfbfc735f43a4e2dce0c849b41ab83dd17228f6df983f7a95d6e427cdc77b0
-
SHA512
103979db357ec67e7637f95aa3047a1eb704fb6f9531f9f1f9f4046ab60aaa0e68d73bc78c144b70c2ce18f3d9d01582621e85750e84e457ea64bfea104efb27
Malware Config
Extracted
formbook
http://www.theatomicshots.com/xle/
tknbr.com
loyaloneconstruction.com
what-where.com
matebacapital.com
marriedandmore.com
qiemfsolutions.com
graececonsulting.com
www7456.com
littlefreecherokeelibrary.com
tailgatepawkinglot.com
musheet.com
tesfamariamtb.com
1728025.com
xceltechuae.com
harperandchloe.com
thepamperedbarber.com
5050alberta.com
supplychainstrainer.com
lacorte.group
ringingbear.com
Targets
-
-
Target
d97a26894ec19dc562eec833ccb5607f.exe
-
Size
1.0MB
-
MD5
d97a26894ec19dc562eec833ccb5607f
-
SHA1
5aa0632c496d7e1441eef50c61c6a97c5adee565
-
SHA256
2fdfbfc735f43a4e2dce0c849b41ab83dd17228f6df983f7a95d6e427cdc77b0
-
SHA512
103979db357ec67e7637f95aa3047a1eb704fb6f9531f9f1f9f4046ab60aaa0e68d73bc78c144b70c2ce18f3d9d01582621e85750e84e457ea64bfea104efb27
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Formbook Payload
-
Suspicious use of SetThreadContext
-