General
-
Target
Mv Maersk Kleven V949E_pdf.exe
-
Size
913KB
-
Sample
210118-e9mvr1wm9e
-
MD5
5281385b7bdbdbd17e1e08d1c0eb1a20
-
SHA1
f2a17bff838159ff075ceb276335e6235195f62a
-
SHA256
b37ed83e211a60e98f12b924df6a9eecebb4b6f5c60cc58aa1468bddc611480f
-
SHA512
d1e50d40531c85046b01f7df66024d716a6f5e25b3a099465183804f0657fcfcf963c1056cdd7d95c88b6b3ba509ffed19048298dfb28e682ed0cc89f146acf7
Malware Config
Extracted
formbook
http://www.embracingmyjourney.net/p7t/
crosvudigital.com
airgreenllc.com
epochryphal.com
handy-domain-listing.com
espaceideecreation.com
3sleeves.com
alotrooms.com
luttelion.com
efekaleci.xyz
allpapas.com
alverazricardez.com
meghandoria.com
deicorp-community.com
877nz.com
bahmanhochmetalwerks.com
teppeisugaya.com
kitrablog.digital
theatermoviebuying.com
ptlycloudy.com
ablehed.pro
Targets
-
-
Target
Mv Maersk Kleven V949E_pdf.exe
-
Size
913KB
-
MD5
5281385b7bdbdbd17e1e08d1c0eb1a20
-
SHA1
f2a17bff838159ff075ceb276335e6235195f62a
-
SHA256
b37ed83e211a60e98f12b924df6a9eecebb4b6f5c60cc58aa1468bddc611480f
-
SHA512
d1e50d40531c85046b01f7df66024d716a6f5e25b3a099465183804f0657fcfcf963c1056cdd7d95c88b6b3ba509ffed19048298dfb28e682ed0cc89f146acf7
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Formbook Payload
-
Deletes itself
-
Suspicious use of SetThreadContext
-