General
-
Target
Shipping document.xlsx
-
Size
2.1MB
-
Sample
210119-9fwjpdg7g6
-
MD5
a9f42b2b846babc81871dbe5bfcf6dea
-
SHA1
a00f4af3ce37dadc350c619297115111f18c1db1
-
SHA256
942ae80ca9f3d10b99da8d422e94850bafc51c498484309a0838e8183038f5a9
-
SHA512
ed4fdbbc7871262195ccbd08895a0475fff770c3a869ca94cc8be42e5ecbc3785f11e4a7e75cfc35f8561351ae470ee0aa522be251e8a8e0287a2386ec11606d
Malware Config
Extracted
formbook
http://www.aftabzahur.com/wgn/
kokokara-life-blog.com
faswear.com
futureleadershiptoday.com
date4done.xyz
thecouponinn.com
bbeycarpetsf.com
propolisnasalspray.com
jinjudiamond.com
goodevectors.com
nehyam.com
evalinkapuppets.com
what-if-statistics.com
rateofrisk.com
impacttestonlinne.com
servis-kaydet.info
coloniacafe.com
marcemarketing.com
aarigging.com
goddesswitchery.com
jasqblo.icu
Targets
-
-
Target
Shipping document.xlsx
-
Size
2.1MB
-
MD5
a9f42b2b846babc81871dbe5bfcf6dea
-
SHA1
a00f4af3ce37dadc350c619297115111f18c1db1
-
SHA256
942ae80ca9f3d10b99da8d422e94850bafc51c498484309a0838e8183038f5a9
-
SHA512
ed4fdbbc7871262195ccbd08895a0475fff770c3a869ca94cc8be42e5ecbc3785f11e4a7e75cfc35f8561351ae470ee0aa522be251e8a8e0287a2386ec11606d
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Formbook Payload
-
Blocklisted process makes network request
-
Executes dropped EXE
-
Loads dropped DLL
-
Uses the VBS compiler for execution
-
Suspicious use of SetThreadContext
-