General
-
Target
9284392fd96b31b3de8d8f664de3f0e4
-
Size
436KB
-
Sample
210915-wsk1dsbba4
-
MD5
9284392fd96b31b3de8d8f664de3f0e4
-
SHA1
9b2e8d834a7e50ec7e674433d019dbd19996036c
-
SHA256
4f8799e5441c553ebbda342b6b06356a70dc432e5ac0434f4158146520b57ab7
-
SHA512
61efcc329ba8f50c32de43ba0bfc66e6591158c12fcb095dfa3652e54fc799255a49e44c62f2022b807d51b432050f85d94a172dc0e186af40a21e3848c7c922
Malware Config
Extracted
formbook
4.1
o4ms
http://www.nocodehost.com/o4ms/
fishingboatpub.com
trebor72.com
qualitycleanaustralia.com
amphilykenyx.com
jayte90.net
alveegrace.com
le-fleursoleil.com
volumoffer.com
businessbookwriters.com
alpin-art.com
firsttastetogo.com
catofc.com
ref-290.com
sbo2008.com
fortlauderdaleelevators.com
shanghaiyalian.com
majestybags.com
afcerd.com
myceliated.com
ls0a.com
Targets
-
-
Target
9284392fd96b31b3de8d8f664de3f0e4
-
Size
436KB
-
MD5
9284392fd96b31b3de8d8f664de3f0e4
-
SHA1
9b2e8d834a7e50ec7e674433d019dbd19996036c
-
SHA256
4f8799e5441c553ebbda342b6b06356a70dc432e5ac0434f4158146520b57ab7
-
SHA512
61efcc329ba8f50c32de43ba0bfc66e6591158c12fcb095dfa3652e54fc799255a49e44c62f2022b807d51b432050f85d94a172dc0e186af40a21e3848c7c922
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Formbook Payload
-
Adds policy Run key to start application
-
Executes dropped EXE
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-