General
-
Target
0d6dc87e3f4948bdedf40980ac0f8f30.exe
-
Size
624KB
-
Sample
210114-6gh33djj22
-
MD5
0d6dc87e3f4948bdedf40980ac0f8f30
-
SHA1
76424fed3a6131f3e49975978343b8836cc11006
-
SHA256
f777596fe0fa9c11e6ff244810d6c6d4846f9c03b8840ad88ac8853de8a766db
-
SHA512
e63d837d9345b2d936b223ad2090032af8debb2323b0d2b5c9341041c740a840ccbecc4df79e60cf972fbe5087fcedcfae3bcb1dbcc71c24128fb454d1fc39ab
Malware Config
Extracted
formbook
http://www.huynhanhdung.com/kna/
lawrencefiredepartment.com
executivehomeoffices.com
solfed.world
oshawaexchange.com
webdavlexstore.com
youpieb.com
chiller-master.com
bearstoragetn.com
daf90x16.com
gewhacaalouine.com
simplyezi.com
cstechnologyservices.com
nosyboats.com
thecocomarie.com
vetinaryeco.club
americangoselfilm.com
gdsuhejia.com
verbunden-sein.net
the-minerva.com
loctrantv.com
Targets
-
-
Target
0d6dc87e3f4948bdedf40980ac0f8f30.exe
-
Size
624KB
-
MD5
0d6dc87e3f4948bdedf40980ac0f8f30
-
SHA1
76424fed3a6131f3e49975978343b8836cc11006
-
SHA256
f777596fe0fa9c11e6ff244810d6c6d4846f9c03b8840ad88ac8853de8a766db
-
SHA512
e63d837d9345b2d936b223ad2090032af8debb2323b0d2b5c9341041c740a840ccbecc4df79e60cf972fbe5087fcedcfae3bcb1dbcc71c24128fb454d1fc39ab
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Formbook Payload
-
Suspicious use of SetThreadContext
-