General
-
Target
RFV9099311042.exe
-
Size
311KB
-
Sample
210114-k69bf3xcs2
-
MD5
eddf5707efb09aae5b194cb84db89374
-
SHA1
0cdf475a4766967164ffd6b61cbf95ab49b9d6b2
-
SHA256
9e98384954932a0a9e5f921f257029bf45f721b0d279c8432c4eb5f1bf507795
-
SHA512
64518ffe185be330d358b077bd0082ba956d7d3aab2b1196c96f4697362f5492de1e670372674b94e457d0e419af1178337a394085fd34bca36ae5d8d54134ac
Malware Config
Extracted
formbook
http://www.unitvn.com/krc/
grayfoxden.com
drupadhyayashomoeopathy.com
coordinatedcare-ok.com
the-legend-update3.com
remoteworkoffer.com
r3dprojects.com
banhuaihangschool.com
7852bigbucktrail.info
villagepizzafloralpark.com
sgtradingusa.com
evolvestephanieperreault.com
timelessbeautylessons.com
monkeytrivia.com
bsf.xyz
canda.design
recetasnutribullet.com
olenfex.com
catatan-matematika.com
roeltecnologiadigital.com
jutoxnatural.com
Targets
-
-
Target
RFV9099311042.exe
-
Size
311KB
-
MD5
eddf5707efb09aae5b194cb84db89374
-
SHA1
0cdf475a4766967164ffd6b61cbf95ab49b9d6b2
-
SHA256
9e98384954932a0a9e5f921f257029bf45f721b0d279c8432c4eb5f1bf507795
-
SHA512
64518ffe185be330d358b077bd0082ba956d7d3aab2b1196c96f4697362f5492de1e670372674b94e457d0e419af1178337a394085fd34bca36ae5d8d54134ac
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Formbook Payload
-
Suspicious use of SetThreadContext
-