General
-
Target
1da3f89b03b99b52a4b0bd21fba02efd.exe
-
Size
970KB
-
Sample
210119-ws6rhf8dls
-
MD5
1da3f89b03b99b52a4b0bd21fba02efd
-
SHA1
3f0a4410db165cd597cf4531f7e6d7a8fc8f2e99
-
SHA256
3013607bfee8bcca1767c2a33cea94602e3c97baba31f96fc8a08014cf2576b4
-
SHA512
0d5d9f5435fd234b2c11b90ddb996b9d8b74b50123834e5660fb848dd5f9f6db687f6794eff4a83008aafc27d1e75490bb13e3eaaf6e74876b9abbc0d97403ba
Malware Config
Extracted
formbook
http://www.embracingmyjourney.net/p7t/
crosvudigital.com
airgreenllc.com
epochryphal.com
handy-domain-listing.com
espaceideecreation.com
3sleeves.com
alotrooms.com
luttelion.com
efekaleci.xyz
allpapas.com
alverazricardez.com
meghandoria.com
deicorp-community.com
877nz.com
bahmanhochmetalwerks.com
teppeisugaya.com
kitrablog.digital
theatermoviebuying.com
ptlycloudy.com
ablehed.pro
Targets
-
-
Target
1da3f89b03b99b52a4b0bd21fba02efd.exe
-
Size
970KB
-
MD5
1da3f89b03b99b52a4b0bd21fba02efd
-
SHA1
3f0a4410db165cd597cf4531f7e6d7a8fc8f2e99
-
SHA256
3013607bfee8bcca1767c2a33cea94602e3c97baba31f96fc8a08014cf2576b4
-
SHA512
0d5d9f5435fd234b2c11b90ddb996b9d8b74b50123834e5660fb848dd5f9f6db687f6794eff4a83008aafc27d1e75490bb13e3eaaf6e74876b9abbc0d97403ba
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Formbook Payload
-
Suspicious use of SetThreadContext
-