General
-
Target
PO-23562#TZ232-DATED19-01-2021.exe
-
Size
1.5MB
-
Sample
210119-wcwjxl5vbn
-
MD5
497a3aba71e4db2cbf7d3746acff93eb
-
SHA1
2e5a0391fd8024bec52d70d10356caa198c79f64
-
SHA256
2ba03179153cd1efd2098bf6fc7870efb2b3a5a60f2b516c4c3dace977627289
-
SHA512
19d819b0809af869a06a8ae2e700135208000b02bc269849aa21bbe94b90ac6fc87e647f0efaf6a58c558bcc143f4fe3c033059f2480182774978410655f5f18
Malware Config
Extracted
formbook
http://www.styrelseforum.com/p95n/
kimberlyrutledge.com
auctus.agency
johnemotions.com
guilt-brilliant.com
wxshangdian.com
theolivetreeonline.com
stellarfranchisebrands.com
every1no1.com
hoangthanhgroup.com
psm-gen.com
kingdomwow.com
digitalksr.com
karynpolitoforlg.com
youthdaycalgary.com
libertyhandymanservicesllc.com
breatheohio.com
allenleather.com
transformafter50.info
hnhsylsb.com
hmtradebd.com
Targets
-
-
Target
PO-23562#TZ232-DATED19-01-2021.exe
-
Size
1.5MB
-
MD5
497a3aba71e4db2cbf7d3746acff93eb
-
SHA1
2e5a0391fd8024bec52d70d10356caa198c79f64
-
SHA256
2ba03179153cd1efd2098bf6fc7870efb2b3a5a60f2b516c4c3dace977627289
-
SHA512
19d819b0809af869a06a8ae2e700135208000b02bc269849aa21bbe94b90ac6fc87e647f0efaf6a58c558bcc143f4fe3c033059f2480182774978410655f5f18
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Formbook Payload
-
Suspicious use of SetThreadContext
-