General
-
Target
Additional DHL shipment Delivery Parcel.exe
-
Size
510KB
-
Sample
210226-5gfsxhxtba
-
MD5
b2fd9aab2f1597f74abda918ddc52f89
-
SHA1
acdf16e4c3a8e0428f7cf1934fdcfe0731b2fc28
-
SHA256
b5ac8902c4d239f5f72366876e99a586d3aaafe45c9a9e098c8ded9a2db7615c
-
SHA512
3297c94b09f6845905f621020821c0ae05a95a0c4e96436f57460aeae5786e7be3acf1d159a0b2282636e2d765715d8d4242be80cfa549fa5d301d05baa175ff
Malware Config
Extracted
formbook
http://www.webperb.com/nehc/
havenmaple.com
katrinasmarket.com
ccharlet.com
everestmedicalgroupusa.net
powervoc.com
crypto300cluv.com
davidrichterlaw.com
parkcitysongfest.com
videogeniusawards.com
beleave.club
gooddeedprocessing.com
synthsup.com
eceiptsworld.com
infinityanalytics.co.uk
damghair.com
sabaidate.com
guitarsir.com
thebowlingspot.com
denturelabmiami.com
mo-cooking.com
Targets
-
-
Target
Additional DHL shipment Delivery Parcel.exe
-
Size
510KB
-
MD5
b2fd9aab2f1597f74abda918ddc52f89
-
SHA1
acdf16e4c3a8e0428f7cf1934fdcfe0731b2fc28
-
SHA256
b5ac8902c4d239f5f72366876e99a586d3aaafe45c9a9e098c8ded9a2db7615c
-
SHA512
3297c94b09f6845905f621020821c0ae05a95a0c4e96436f57460aeae5786e7be3acf1d159a0b2282636e2d765715d8d4242be80cfa549fa5d301d05baa175ff
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Formbook Payload
-
Deletes itself
-
Suspicious use of SetThreadContext
-