General
-
Target
f958e1e18b67ac9edc2668bac133b64a.exe
-
Size
1.4MB
-
Sample
210119-n9fsjxyng2
-
MD5
f958e1e18b67ac9edc2668bac133b64a
-
SHA1
d92e70bac00a8c0d3067f5ae8589f8a5edd8270a
-
SHA256
5adeb6184ee1dffad88ac180f1e7dcbd6f451fc8dcd5e868906fca11d98476ef
-
SHA512
fc601ddf117a61160baa8b04ef9e70d577168abfdb65913eea5897a47f9b858e699f86e11908da476d27021eefaa3e253773b9107e658c883adda6bbfbcb50fb
Malware Config
Extracted
formbook
http://www.embracingmyjourney.net/p7t/
crosvudigital.com
airgreenllc.com
epochryphal.com
handy-domain-listing.com
espaceideecreation.com
3sleeves.com
alotrooms.com
luttelion.com
efekaleci.xyz
allpapas.com
alverazricardez.com
meghandoria.com
deicorp-community.com
877nz.com
bahmanhochmetalwerks.com
teppeisugaya.com
kitrablog.digital
theatermoviebuying.com
ptlycloudy.com
ablehed.pro
Targets
-
-
Target
f958e1e18b67ac9edc2668bac133b64a.exe
-
Size
1.4MB
-
MD5
f958e1e18b67ac9edc2668bac133b64a
-
SHA1
d92e70bac00a8c0d3067f5ae8589f8a5edd8270a
-
SHA256
5adeb6184ee1dffad88ac180f1e7dcbd6f451fc8dcd5e868906fca11d98476ef
-
SHA512
fc601ddf117a61160baa8b04ef9e70d577168abfdb65913eea5897a47f9b858e699f86e11908da476d27021eefaa3e253773b9107e658c883adda6bbfbcb50fb
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Formbook Payload
-
Suspicious use of SetThreadContext
-