General
-
Target
cdda4c2d3b77ae7bf4f6570add64fee8.exe
-
Size
1.4MB
-
Sample
210119-debzln1px6
-
MD5
cdda4c2d3b77ae7bf4f6570add64fee8
-
SHA1
bf67e7bb72d5141e116858d6debd871c1ef01f2f
-
SHA256
743f890d93b9f2974c3770efbd0c9f07e0a866542d45572ccf47946673b60874
-
SHA512
b8b3363f63bba361bdcb60b40682562bece51f8f1bd28f86e608f3f97b83280ea2ebac86527bcf2d0204faf0d34166cb250fca877eeaec4d40330832db7e707c
Malware Config
Extracted
formbook
http://www.huynhanhdung.com/kna/
lawrencefiredepartment.com
executivehomeoffices.com
solfed.world
oshawaexchange.com
webdavlexstore.com
youpieb.com
chiller-master.com
bearstoragetn.com
daf90x16.com
gewhacaalouine.com
simplyezi.com
cstechnologyservices.com
nosyboats.com
thecocomarie.com
vetinaryeco.club
americangoselfilm.com
gdsuhejia.com
verbunden-sein.net
the-minerva.com
loctrantv.com
Targets
-
-
Target
cdda4c2d3b77ae7bf4f6570add64fee8.exe
-
Size
1.4MB
-
MD5
cdda4c2d3b77ae7bf4f6570add64fee8
-
SHA1
bf67e7bb72d5141e116858d6debd871c1ef01f2f
-
SHA256
743f890d93b9f2974c3770efbd0c9f07e0a866542d45572ccf47946673b60874
-
SHA512
b8b3363f63bba361bdcb60b40682562bece51f8f1bd28f86e608f3f97b83280ea2ebac86527bcf2d0204faf0d34166cb250fca877eeaec4d40330832db7e707c
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Formbook Payload
-
Suspicious use of SetThreadContext
-