General
-
Target
inss.exe
-
Size
312KB
-
Sample
210114-jexvxb1bfa
-
MD5
b6261a6fd212f3fff1ee509c5b26ea43
-
SHA1
a9039586f41a042625ebe7609cb6802204d3f3a8
-
SHA256
02cd99f8d843c4c63d55b4bebe044e5205e81f31ad36af77b9a99734c074f0a8
-
SHA512
99f9032a300fb95c8f959d815df42255f2b15c516ddd494158cdef6293023bf53e9c78dcbd2244be9732a0da6dcaa38ddf16da1e8a64ec0f1b893f4b6f4dfa83
Malware Config
Extracted
formbook
http://www.besthandstool.icu/uds2/
hrrecruitertraining.com
pancakeroll.club
equiposddl.com
fab-9corporation.com
seanformo.com
fisika-uinam.com
cheeseburgerpasta.com
cherylkarlfineartist.com
wunderprodukte.net
3912699.com
sanitizyo.com
856381190.xyz
aprobet42.xyz
knutsfastigheter.com
disalvospizzaitalian.com
energysavingsolarpower.com
oldwonderful.com
se32688.com
samkecollection.com
colegioreynosa.com
Targets
-
-
Target
inss.exe
-
Size
312KB
-
MD5
b6261a6fd212f3fff1ee509c5b26ea43
-
SHA1
a9039586f41a042625ebe7609cb6802204d3f3a8
-
SHA256
02cd99f8d843c4c63d55b4bebe044e5205e81f31ad36af77b9a99734c074f0a8
-
SHA512
99f9032a300fb95c8f959d815df42255f2b15c516ddd494158cdef6293023bf53e9c78dcbd2244be9732a0da6dcaa38ddf16da1e8a64ec0f1b893f4b6f4dfa83
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Formbook Payload
-
Deletes itself
-
Suspicious use of SetThreadContext
-