General
-
Target
b55b31cbefb2c6334eab9e955a208803.exe
-
Size
1.4MB
-
Sample
210119-2w3cemr8nj
-
MD5
b55b31cbefb2c6334eab9e955a208803
-
SHA1
855712c2caa34130c687c32fbc80eb0308b6131e
-
SHA256
410e324656b57d2eb5e1c0eabbdbda34d787f346ab817f1afbc388ea615c2585
-
SHA512
7f895a902c0383d109fa7c6ed49658c3cf605b053e435360eca962265feb9efd503b02faf9606dc474f157ab2d0eb558471da267510e56464a0a3548c5d97b5b
Malware Config
Extracted
formbook
http://www.theatomicshots.com/xle/
tknbr.com
loyaloneconstruction.com
what-where.com
matebacapital.com
marriedandmore.com
qiemfsolutions.com
graececonsulting.com
www7456.com
littlefreecherokeelibrary.com
tailgatepawkinglot.com
musheet.com
tesfamariamtb.com
1728025.com
xceltechuae.com
harperandchloe.com
thepamperedbarber.com
5050alberta.com
supplychainstrainer.com
lacorte.group
ringingbear.com
Targets
-
-
Target
b55b31cbefb2c6334eab9e955a208803.exe
-
Size
1.4MB
-
MD5
b55b31cbefb2c6334eab9e955a208803
-
SHA1
855712c2caa34130c687c32fbc80eb0308b6131e
-
SHA256
410e324656b57d2eb5e1c0eabbdbda34d787f346ab817f1afbc388ea615c2585
-
SHA512
7f895a902c0383d109fa7c6ed49658c3cf605b053e435360eca962265feb9efd503b02faf9606dc474f157ab2d0eb558471da267510e56464a0a3548c5d97b5b
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Formbook Payload
-
Suspicious use of SetThreadContext
-