General
-
Target
b4b99dde2afeeb4da6b582a1b2735422.exe
-
Size
1.4MB
-
Sample
210120-2vdn3z2k7j
-
MD5
b4b99dde2afeeb4da6b582a1b2735422
-
SHA1
68bdee65a21cb784177b20da4f1078452f9b7224
-
SHA256
701e73e5e7ece8e23a505a09b1f41d1a282406c0b11b42115896f8ab34a626af
-
SHA512
c86e479ec3a80f5e7151e7838590de24883109fb00e3fd671f1b8ce661a40470f61b12bc796b7b286f9d69636a8e74c161102b75d7123c4fbf4d36a13b5b45db
Malware Config
Extracted
formbook
http://www.theatomicshots.com/xle/
tknbr.com
loyaloneconstruction.com
what-where.com
matebacapital.com
marriedandmore.com
qiemfsolutions.com
graececonsulting.com
www7456.com
littlefreecherokeelibrary.com
tailgatepawkinglot.com
musheet.com
tesfamariamtb.com
1728025.com
xceltechuae.com
harperandchloe.com
thepamperedbarber.com
5050alberta.com
supplychainstrainer.com
lacorte.group
ringingbear.com
Targets
-
-
Target
b4b99dde2afeeb4da6b582a1b2735422.exe
-
Size
1.4MB
-
MD5
b4b99dde2afeeb4da6b582a1b2735422
-
SHA1
68bdee65a21cb784177b20da4f1078452f9b7224
-
SHA256
701e73e5e7ece8e23a505a09b1f41d1a282406c0b11b42115896f8ab34a626af
-
SHA512
c86e479ec3a80f5e7151e7838590de24883109fb00e3fd671f1b8ce661a40470f61b12bc796b7b286f9d69636a8e74c161102b75d7123c4fbf4d36a13b5b45db
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Formbook Payload
-
Suspicious use of SetThreadContext
-