General
-
Target
1.exe
-
Size
184KB
-
Sample
210824-h26jbvxa5x
-
MD5
a07af50447cdcd3e6171b274894c0067
-
SHA1
d6a4a04a1472104d224a0fb46c204e3cc44e264e
-
SHA256
328ba91220f66fb35b757598b5d7a492ac352406300003a86fb366360d4fcf09
-
SHA512
eae45defc6965660eed2a2b8778b9b1125b10e331623ed29bccdfcb18b18a03bf8b0ff0f420df3affd3d6d1de5229c4fa981e8b42d9ef714a9e6e911e6b9d56e
Malware Config
Extracted
formbook
4.1
n7ak
http://www.kmresults.com/n7ak/
modischoolcbse.com
theneverwinter.com
rszkjx-vps-hosting.website
fnihil.com
1pbet.com
nnowzscorrez.com
uaotgvjl.icu
starmapsqatar.com
ekisilani.com
extradeepsheets.com
jam-nins.com
buranly.com
orixentertainment.com
rawtech.energy
myol.guru
utex.club
jiapie.com
wowig.store
wweidlyyl.com
systaskautomation.com
Targets
-
-
Target
1.exe
-
Size
184KB
-
MD5
a07af50447cdcd3e6171b274894c0067
-
SHA1
d6a4a04a1472104d224a0fb46c204e3cc44e264e
-
SHA256
328ba91220f66fb35b757598b5d7a492ac352406300003a86fb366360d4fcf09
-
SHA512
eae45defc6965660eed2a2b8778b9b1125b10e331623ed29bccdfcb18b18a03bf8b0ff0f420df3affd3d6d1de5229c4fa981e8b42d9ef714a9e6e911e6b9d56e
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Formbook Payload
-
Blocklisted process makes network request
-
Deletes itself
-
Suspicious use of SetThreadContext
-