General
-
Target
Proforma Invoice No.42037 dated 26032021 for USD.78116.pdf.exe
-
Size
1.2MB
-
Sample
210726-4caxydmmq6
-
MD5
8c64b248212fd63f7c0cfdca16b6b5aa
-
SHA1
1ae15b049c1059d1e43ae5851005f50826c0d0b2
-
SHA256
88a9cfa636128b92a40156cdabb79f0058c7cf70bc392e60a9e8ec6c1090e6cf
-
SHA512
79581d25d4f35e1ae175f9b62789e1e8cf48b003f7f903a7a794aa85e43e2c8b73c890346f1608cdc13b9d6d42f4078184ee70709876e1dbfddd3c077a58cb0b
Malware Config
Extracted
formbook
4.1
http://www.elitegamerblog.com/gsg0/
telprix.com
multiremates.com
heytiday.com
toporganik.com
tutorincranleigh.com
oakandolivemalibu.com
ronaldvalentine.com
waytopshop.com
mythai-massage.com
matrixresults.com
teamwork256.com
qqemas.men
qnmark.com
rock-singer.com
mobiledevpros.com
miramar-agents.com
desjour.com
edensplace.net
ryanrafuls.com
xg8197.com
Targets
-
-
Target
Proforma Invoice No.42037 dated 26032021 for USD.78116.pdf.exe
-
Size
1.2MB
-
MD5
8c64b248212fd63f7c0cfdca16b6b5aa
-
SHA1
1ae15b049c1059d1e43ae5851005f50826c0d0b2
-
SHA256
88a9cfa636128b92a40156cdabb79f0058c7cf70bc392e60a9e8ec6c1090e6cf
-
SHA512
79581d25d4f35e1ae175f9b62789e1e8cf48b003f7f903a7a794aa85e43e2c8b73c890346f1608cdc13b9d6d42f4078184ee70709876e1dbfddd3c077a58cb0b
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
CustAttr .NET packer
Detects CustAttr .NET packer in memory.
-
Formbook Payload
-
Deletes itself
-
Suspicious use of SetThreadContext
-