General
-
Target
REVISED INVOICE.rar
-
Size
491KB
-
Sample
210727-k9cnq2kqsa
-
MD5
f4a464a28dbd5dab47dc03564a5e9211
-
SHA1
9e2b501477965032d06155536acac1a406cd19a6
-
SHA256
747e90de3fdc97a7fec4245b0298db8d5b97bded1cf19e4b25fb912797899885
-
SHA512
09ade27b36bf949e75725fb9afc1da3ef678e14141f25658dd095bea133a017cfad61cf2f3c2de2cda1ef60262d66b189b5f10370bdd5d43ab7812bcc84dc23c
Malware Config
Extracted
formbook
4.1
http://www.fabricwarehousebrla.com/mjf5/
scxmarine.com
4week-keto-results.com
alllivesmattertojesus.info
stoxets.com
psm-gen.com
u2collect.com
steveandgail.com
dgemediagroup.com
ragsxghi.com
hirobasushinv.com
fcvlamingo.com
thebrownseaproject.com
achalaproductions.com
unstoppableinvesting.com
epay12303.com
polenmoda.com
pgpitagi.com
picksfacts.com
allhubph.com
negociandocomvocebr.com
Targets
-
-
Target
REVISED INVOICE.exe
-
Size
607KB
-
MD5
6b5c6aefc470e66a1d12bc56437f48a0
-
SHA1
e5c903c9a731c3abfbdb5141d926616bf7b54beb
-
SHA256
35a2017af959b6e43cb129fc6c18c7e21bc0a1d850b1e74101bbb95d8c5bd3c0
-
SHA512
704503ceaef70125d52e42cc75cf5dad0c05e27564ed67aef5605ade8cce461100c37598c1c798ea7d39e2f6635ca7c1cd9d7f76725d749769b2c5d414c7c34b
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
CustAttr .NET packer
Detects CustAttr .NET packer in memory.
-
Formbook Payload
-
Deletes itself
-
Suspicious use of SetThreadContext
-