General
-
Target
Proforma Invoice No.42037 dated 26032021 for USD.78116.pdf.gz
-
Size
953KB
-
Sample
210726-xhfemg6t32
-
MD5
97c951d059b288299269d968a146a96b
-
SHA1
e8e8c2b9d2f22d52ec021813096190168ce5872a
-
SHA256
4245864df59a60102fb28a3f19a9ecd8f44501c34d0f217811bf84c4b4d8d4ab
-
SHA512
35c9b7806a789233ac70e691670109dbc364e8725d78ae453f24acf51a7492293dfe1c4edc1f822ab7f4479ecccdaf4a743ac254626e212e6953d895a7dd5102
Malware Config
Extracted
formbook
4.1
http://www.elitegamerblog.com/gsg0/
telprix.com
multiremates.com
heytiday.com
toporganik.com
tutorincranleigh.com
oakandolivemalibu.com
ronaldvalentine.com
waytopshop.com
mythai-massage.com
matrixresults.com
teamwork256.com
qqemas.men
qnmark.com
rock-singer.com
mobiledevpros.com
miramar-agents.com
desjour.com
edensplace.net
ryanrafuls.com
xg8197.com
Targets
-
-
Target
Proforma Invoice No.42037 dated 26032021 for USD.78116.pdf.exe
-
Size
1.2MB
-
MD5
8c64b248212fd63f7c0cfdca16b6b5aa
-
SHA1
1ae15b049c1059d1e43ae5851005f50826c0d0b2
-
SHA256
88a9cfa636128b92a40156cdabb79f0058c7cf70bc392e60a9e8ec6c1090e6cf
-
SHA512
79581d25d4f35e1ae175f9b62789e1e8cf48b003f7f903a7a794aa85e43e2c8b73c890346f1608cdc13b9d6d42f4078184ee70709876e1dbfddd3c077a58cb0b
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
CustAttr .NET packer
Detects CustAttr .NET packer in memory.
-
Formbook Payload
-
Deletes itself
-
Suspicious use of SetThreadContext
-