General
-
Target
REVISED INVOICE.exe
-
Size
607KB
-
Sample
210727-95jtd1fs6x
-
MD5
6b5c6aefc470e66a1d12bc56437f48a0
-
SHA1
e5c903c9a731c3abfbdb5141d926616bf7b54beb
-
SHA256
35a2017af959b6e43cb129fc6c18c7e21bc0a1d850b1e74101bbb95d8c5bd3c0
-
SHA512
704503ceaef70125d52e42cc75cf5dad0c05e27564ed67aef5605ade8cce461100c37598c1c798ea7d39e2f6635ca7c1cd9d7f76725d749769b2c5d414c7c34b
Malware Config
Extracted
formbook
4.1
http://www.fabricwarehousebrla.com/mjf5/
scxmarine.com
4week-keto-results.com
alllivesmattertojesus.info
stoxets.com
psm-gen.com
u2collect.com
steveandgail.com
dgemediagroup.com
ragsxghi.com
hirobasushinv.com
fcvlamingo.com
thebrownseaproject.com
achalaproductions.com
unstoppableinvesting.com
epay12303.com
polenmoda.com
pgpitagi.com
picksfacts.com
allhubph.com
negociandocomvocebr.com
Targets
-
-
Target
REVISED INVOICE.exe
-
Size
607KB
-
MD5
6b5c6aefc470e66a1d12bc56437f48a0
-
SHA1
e5c903c9a731c3abfbdb5141d926616bf7b54beb
-
SHA256
35a2017af959b6e43cb129fc6c18c7e21bc0a1d850b1e74101bbb95d8c5bd3c0
-
SHA512
704503ceaef70125d52e42cc75cf5dad0c05e27564ed67aef5605ade8cce461100c37598c1c798ea7d39e2f6635ca7c1cd9d7f76725d749769b2c5d414c7c34b
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
CustAttr .NET packer
Detects CustAttr .NET packer in memory.
-
Formbook Payload
-
Deletes itself
-
Suspicious use of SetThreadContext
-