General
-
Target
2218003603 92390-00.xlsx
-
Size
1.3MB
-
Sample
210118-cnhtgv9v3n
-
MD5
1a3223dc142b11cb7e4a2e4c42d8ba99
-
SHA1
9fb84ca1ecd5c63b776f207923af1787ec64e0e9
-
SHA256
624a702ccbc488c9702b2ff1f0e73a6606771837cd5a8516ccfd76f78fabab32
-
SHA512
fa07df7dda909fa5f44142c769ac1412633217d3de5f543ece5fd3d2836348a13496748a0f8b8d2297802694eeb449be2b985ec461ac728ec29b03fe2764c6ab
Malware Config
Extracted
formbook
http://www.theatomicshots.com/xle/
tknbr.com
loyaloneconstruction.com
what-where.com
matebacapital.com
marriedandmore.com
qiemfsolutions.com
graececonsulting.com
www7456.com
littlefreecherokeelibrary.com
tailgatepawkinglot.com
musheet.com
tesfamariamtb.com
1728025.com
xceltechuae.com
harperandchloe.com
thepamperedbarber.com
5050alberta.com
supplychainstrainer.com
lacorte.group
ringingbear.com
Targets
-
-
Target
2218003603 92390-00.xlsx
-
Size
1.3MB
-
MD5
1a3223dc142b11cb7e4a2e4c42d8ba99
-
SHA1
9fb84ca1ecd5c63b776f207923af1787ec64e0e9
-
SHA256
624a702ccbc488c9702b2ff1f0e73a6606771837cd5a8516ccfd76f78fabab32
-
SHA512
fa07df7dda909fa5f44142c769ac1412633217d3de5f543ece5fd3d2836348a13496748a0f8b8d2297802694eeb449be2b985ec461ac728ec29b03fe2764c6ab
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Formbook Payload
-
Blocklisted process makes network request
-
Executes dropped EXE
-
Loads dropped DLL
-
Uses the VBS compiler for execution
-
Suspicious use of SetThreadContext
-