General
-
Target
w73FtMA4ZTl9NFm.exe
-
Size
762KB
-
Sample
210504-rpky9kv746
-
MD5
ff44bfe6955f4d11f915b4a0b818fc7c
-
SHA1
3e094caff011346ad02aeafcb5769a519cf10dc0
-
SHA256
929fd55e632471f4f35295e574c6814a3de9662398b7a606e352ecba9c52de7e
-
SHA512
f4ee80c0bb0bae5532b880ffa704d8d99f06c0c6b3699b95be3e802347345b7cc62251ff16a0a1023303a1a72f987d39be271579652c0364485a82e7e2ab649d
Malware Config
Extracted
formbook
4.1
http://www.naiping8.com/blm/
basilaws.com
laesses.com
isematsudai.com
cafperfect.com
listocalistoanimation.com
bikesofthefuture.com
sweette.com
instagramhelpsnow.com
wuxians.com
canadianpayday.loans
tiklaulan.xyz
marketingbuddhi.com
centrocaninopochs.com
doodletrends.com
praiship.com
alghuta.com
kompramania.com
thenewdawncompany.com
shopthegoodbar.com
emergencyuavsolutions.com
Targets
-
-
Target
w73FtMA4ZTl9NFm.exe
-
Size
762KB
-
MD5
ff44bfe6955f4d11f915b4a0b818fc7c
-
SHA1
3e094caff011346ad02aeafcb5769a519cf10dc0
-
SHA256
929fd55e632471f4f35295e574c6814a3de9662398b7a606e352ecba9c52de7e
-
SHA512
f4ee80c0bb0bae5532b880ffa704d8d99f06c0c6b3699b95be3e802347345b7cc62251ff16a0a1023303a1a72f987d39be271579652c0364485a82e7e2ab649d
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Formbook Payload
-
Suspicious use of SetThreadContext
-