General
-
Target
202139769574 Shipping Documents.exe
-
Size
229KB
-
Sample
210504-kms4shlzmj
-
MD5
eee5f618718bc8237bb9c7a48154cf1a
-
SHA1
84dc873f65dc9e86978944d1adddb762efcf2631
-
SHA256
cc7b066e0fa912d406c27790458ad6feb171b27275b6e3fe46b7a7574da7bfce
-
SHA512
8f49fab9642c63814bc77ff302d05719d92404fe38bd220060a161c51b3f6f129bd5c4b2a4b3a2e1e239488e31f157f32b772505f8501003682cc9904d205c57
Malware Config
Extracted
formbook
4.1
http://www.magnumopuspro.com/nyr/
anemone-vintage.com
ironcitytools.com
joshandmatthew.com
breathtakingscenery.photos
karabakh-terror.com
micahelgall.com
entretiendesterrasses.com
mhgholdings.com
blewm.com
sidewalknotary.com
ytrs-elec.com
danhpham.com
ma21cle2henz.xyz
lotusforlease.com
shipleyphotoandfilm.com
bulktool.xyz
ouedzmala.com
yichengvpr.com
connectmygames.com
chjcsc.com
Targets
-
-
Target
202139769574 Shipping Documents.exe
-
Size
229KB
-
MD5
eee5f618718bc8237bb9c7a48154cf1a
-
SHA1
84dc873f65dc9e86978944d1adddb762efcf2631
-
SHA256
cc7b066e0fa912d406c27790458ad6feb171b27275b6e3fe46b7a7574da7bfce
-
SHA512
8f49fab9642c63814bc77ff302d05719d92404fe38bd220060a161c51b3f6f129bd5c4b2a4b3a2e1e239488e31f157f32b772505f8501003682cc9904d205c57
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Formbook Payload
-
Deletes itself
-
Loads dropped DLL
-
Suspicious use of SetThreadContext
-