General
-
Target
inductothermindia.rar
-
Size
418KB
-
Sample
210916-vmwz2adgg6
-
MD5
ff6f6132455545a74c58b7b0fe1b19a0
-
SHA1
0d2555dc61ee9b297f88418798275aee1420c186
-
SHA256
44a39dd80227c1e0a7b71fd5cce737871a13249f5518ed8dce856166ddd9045f
-
SHA512
f131b6f87b21aaa8f75efa61a6d7f36086579c2186c67f9c5d75f070ff76d27f1085d44ef0b2ff51e1d60a4eb380a0b8383c0dadd3bc1032a02b9152d0d90871
Malware Config
Extracted
formbook
4.1
pm7s
http://www.rafaelcristino.com/pm7s/
angrypeacocks.site
theindependentartlable.com
coachingforthewin.com
localbizsc.com
drive-a-supercar.com
mewsette.com
scinuh.com
gurugramaffordablehomes.com
riamedefarm.com
richfitzfashions.com
u9j1o.info
dife-rent.com
talesfromthequadrat.com
dandfmotors.com
springtexasdentist.com
gobakala.store
earlyeducationglobal.com
sdrxsb.site
dreamlifebiz.com
theurbancaveshop.com
Targets
-
-
Target
inductothermindia.exe
-
Size
487KB
-
MD5
ba1672ded82ad0202c4a942129279d6f
-
SHA1
5e9f62fdc033050802fa58d50e6216fdddf8d746
-
SHA256
8daea2a88b107bafc48119beeb68e3f8ea56a645190851150cff84e97a38ee2b
-
SHA512
d52d5a9c5e580c64af68cbd375fa5ffa6e4eb4917fa3ae375fac6fa87c77b7c8f711524ee47d8f7ee10a5a185fc2b192e51ac00bfbd7cb58b1a91fbeb98b80b7
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Formbook Payload
-
Deletes itself
-
Suspicious use of SetThreadContext
-