General
-
Target
novi nalog je u prilogu.exe
-
Size
831KB
-
Sample
210419-vjn8p78y1e
-
MD5
fe3d05f5903abce1faaf89b0afd3744e
-
SHA1
3b4da5ba14989a18614a91a844c67a6a8d8b6f84
-
SHA256
5281533c78892f2b571668ef9c770ce9c04ee249397040db9b5975ed47601474
-
SHA512
164d235c4ebfb76ff010e461f4a09b99897e9df54ded6ae0364608835d59422a808f038529dfe829ee9bd13a2b73517c76cc65f1a1ac77142f79686871dcdec0
Malware Config
Extracted
formbook
4.1
http://www.joomlas123.info/3nop/
bakecakesandmore.com
shenglisuoye.com
chinapopfactory.com
ynlrhd.com
liqourforyou.com
leonqamil.com
meccafon.com
online-marketing-strategie.biz
rbfxi.com
frseyb.info
leyu91.com
hotsmail.today
beepot.tech
dunaemmetmobility.com
sixpenceworkshop.com
incrediblefavorcoaching.com
pofo.info
yanshudaili.com
yellowbrickwedding.com
paintpartyblueprint.com
Targets
-
-
Target
novi nalog je u prilogu.exe
-
Size
831KB
-
MD5
fe3d05f5903abce1faaf89b0afd3744e
-
SHA1
3b4da5ba14989a18614a91a844c67a6a8d8b6f84
-
SHA256
5281533c78892f2b571668ef9c770ce9c04ee249397040db9b5975ed47601474
-
SHA512
164d235c4ebfb76ff010e461f4a09b99897e9df54ded6ae0364608835d59422a808f038529dfe829ee9bd13a2b73517c76cc65f1a1ac77142f79686871dcdec0
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Formbook Payload
-
Adds policy Run key to start application
-
Adds Run key to start application
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Suspicious use of SetThreadContext
-