General
-
Target
novi nalog je u prilogu.zip
-
Size
377KB
-
Sample
210419-m1qhyh7lg6
-
MD5
a8b43a9cb30e654685a9fe635d74b80b
-
SHA1
5647c730e6a5fabc7305054fd1b6edd58cfa4ae8
-
SHA256
4dbe0f5d2889bd7b4cc488e10c688480f7e57db544bf779cc6fbdaf0db5536cd
-
SHA512
f6deffcddd287e13aa5753f550a289d2e3d50a54e68494abc43f4069efc0538620ba7aba3d097fd01bda392c4064e1c566ba0ce54362004d5073f014a234f6d8
Malware Config
Extracted
formbook
4.1
http://www.joomlas123.info/3nop/
bakecakesandmore.com
shenglisuoye.com
chinapopfactory.com
ynlrhd.com
liqourforyou.com
leonqamil.com
meccafon.com
online-marketing-strategie.biz
rbfxi.com
frseyb.info
leyu91.com
hotsmail.today
beepot.tech
dunaemmetmobility.com
sixpenceworkshop.com
incrediblefavorcoaching.com
pofo.info
yanshudaili.com
yellowbrickwedding.com
paintpartyblueprint.com
Targets
-
-
Target
novi nalog je u prilogu.exe
-
Size
831KB
-
MD5
fe3d05f5903abce1faaf89b0afd3744e
-
SHA1
3b4da5ba14989a18614a91a844c67a6a8d8b6f84
-
SHA256
5281533c78892f2b571668ef9c770ce9c04ee249397040db9b5975ed47601474
-
SHA512
164d235c4ebfb76ff010e461f4a09b99897e9df54ded6ae0364608835d59422a808f038529dfe829ee9bd13a2b73517c76cc65f1a1ac77142f79686871dcdec0
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Formbook Payload
-
Adds Run key to start application
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Suspicious use of SetThreadContext
-