General
-
Target
Mv Maersk Kleven V949E_pdf.exe
-
Size
850KB
-
Sample
210114-hm7q2j6cjj
-
MD5
b9df17359c7c49389acb9d374464a780
-
SHA1
0edbf3c732a2afb16be8041e6a45133449b186eb
-
SHA256
56db76250b06a9b52b44a9cc88161cd8fb070c4b72aae4f2186362875edac275
-
SHA512
9c394b2d1e4973338686124ad48851571682cd0cd38f67e067498492c43ec60a8f839729bf88a62bc7b3b66c7f103776789ca7516b1fc5fc5c9cd980d26da27d
Malware Config
Extracted
formbook
http://www.embracingmyjourney.net/p7t/
crosvudigital.com
airgreenllc.com
epochryphal.com
handy-domain-listing.com
espaceideecreation.com
3sleeves.com
alotrooms.com
luttelion.com
efekaleci.xyz
allpapas.com
alverazricardez.com
meghandoria.com
deicorp-community.com
877nz.com
bahmanhochmetalwerks.com
teppeisugaya.com
kitrablog.digital
theatermoviebuying.com
ptlycloudy.com
ablehed.pro
Targets
-
-
Target
Mv Maersk Kleven V949E_pdf.exe
-
Size
850KB
-
MD5
b9df17359c7c49389acb9d374464a780
-
SHA1
0edbf3c732a2afb16be8041e6a45133449b186eb
-
SHA256
56db76250b06a9b52b44a9cc88161cd8fb070c4b72aae4f2186362875edac275
-
SHA512
9c394b2d1e4973338686124ad48851571682cd0cd38f67e067498492c43ec60a8f839729bf88a62bc7b3b66c7f103776789ca7516b1fc5fc5c9cd980d26da27d
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Formbook Payload
-
Deletes itself
-
Suspicious use of SetThreadContext
-