General
-
Target
Request for Quotation.7z
-
Size
414KB
-
Sample
210226-q25btdnccx
-
MD5
0195ed72c6105a05d78d72f6a8e3c779
-
SHA1
d69add916f04421212d417c5fe143fec0d2cd321
-
SHA256
1430ca0a818541c464fc1df05702ef90bfab5e74005ba9cc78ca82730efe0236
-
SHA512
5388baec7102cc2a5352dce36b4015e92bca7e136b996627e285802107ac42a9d1c5d153e59f8c2b529e6786715de11183117babeef97f9dd2d5eaf57d3ac232
Malware Config
Extracted
formbook
http://www.fptableau.com/u3q/
wingenomics.com
malwaredeepdive.com
uvdxkup.icu
safeweb-url624.com
lighthousetan.com
liumeilin.com
thaiexpressnyc.com
primedperspective.com
georgekwalker.com
purelife-gt.com
theboseproject.com
moralalaska.icu
anthonysoflittleitaly.com
talahadavi.com
waterbrooksacademy.com
aluneaproaieauayauwpalaua.com
mytshirtforlife.com
penerbitlayung.com
chainslugs.com
bhbgsc.com
Targets
-
-
Target
Request for Quotation.exe
-
Size
500KB
-
MD5
1d9fd84bc6eaa80b160bd313750f6ff5
-
SHA1
011e1975d6cb6a567ad3fed83d59310728bd9227
-
SHA256
1df6109d033a42d97b34133e69afc0da679586b85b6614b034ebfd9343062d20
-
SHA512
d66d0a83284f6f21e711c3d62bcd280042d6a50125dc410b4c79d6f6dba7be5b6bd628fb21e6491b2bb291770f6d1c3951257e948dcbbb587e397fc75296a8da
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Beds Protector Packer
Detects Beds Protector packer used to load .NET malware.
-
Formbook Payload
-
Deletes itself
-
Suspicious use of SetThreadContext
-