General
-
Target
Pago SWIFT pdf.exe.xz
-
Size
281KB
-
Sample
210910-vaq81sadb5
-
MD5
9e958f481652dede832f092f7b9f960c
-
SHA1
95eee4faae39dec452a0769c314fba0b705a6f3a
-
SHA256
adac7addd00f5657827e96d6eba70bf778bb5d60dd2a895a2606b6432d6557fe
-
SHA512
bbdba558e0c891a58cbe38512b1da15cb1f861793b6bdbd05f4ce461e5e22cd373ade8e6f1930dd3fcaadcc7f4a4261ec22dd7aadff28646137cebcad123018e
Malware Config
Extracted
formbook
4.1
n7ak
http://www.kmresults.com/n7ak/
modischoolcbse.com
theneverwinter.com
rszkjx-vps-hosting.website
fnihil.com
1pbet.com
nnowzscorrez.com
uaotgvjl.icu
starmapsqatar.com
ekisilani.com
extradeepsheets.com
jam-nins.com
buranly.com
orixentertainment.com
rawtech.energy
myol.guru
utex.club
jiapie.com
wowig.store
wweidlyyl.com
systaskautomation.com
Targets
-
-
Target
Pago SWIFT pdf.exe
-
Size
891KB
-
MD5
1505509784ed0f39d6ff3ddeddf1ddae
-
SHA1
59c62e59db2e676f0c9979099b575882960b443e
-
SHA256
765e0940eaf99170b294b17de1c825788ac0cd5ca9fd00e811eb81219fae748e
-
SHA512
1093896411a9506bf045ca90bfc045ccdc6482ffb9afb9e715549f2ad78f3f3e3a3079274d5a55a41ca9595201730c98f097491d3aaca80763758ceef5b39162
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Formbook Payload
-
Suspicious use of SetThreadContext
-