General
-
Target
4909043120504832.zip
-
Size
342KB
-
Sample
210921-yjl77sdbcj
-
MD5
b2333dbe4450f3ffb258423f17e55344
-
SHA1
cd6ad1e7e03ea836060390aa0633bd783c070a2d
-
SHA256
556f47dd7cf496aed324545c0fb439b15ef6f5d276862dea73bc8d9b9aa8aaec
-
SHA512
36ecc7dfeb81908bf78f89a6a192b202618b4708d4f9285ce189b275c9e9db104f46172842c3e69f512d74c22a380ba2b3d77b8cc3838d313670371775d25854
Malware Config
Extracted
formbook
4.1
n7ak
http://www.kmresults.com/n7ak/
modischoolcbse.com
theneverwinter.com
rszkjx-vps-hosting.website
fnihil.com
1pbet.com
nnowzscorrez.com
uaotgvjl.icu
starmapsqatar.com
ekisilani.com
extradeepsheets.com
jam-nins.com
buranly.com
orixentertainment.com
rawtech.energy
myol.guru
utex.club
jiapie.com
wowig.store
wweidlyyl.com
systaskautomation.com
Targets
-
-
Target
994a9f45f0d0044d1dbe654ca8dfb4573abb6b20400b0563d8d1c88b1a6a025e~
-
Size
1.1MB
-
MD5
6f74e34ecd92395aefc707edf4119d71
-
SHA1
1d549f12ccf0fa9a429592795ee2c0e103534b91
-
SHA256
b8b54b232ca4f2ee4362d0d66218e77fbd950922221ab00676d43877904e249b
-
SHA512
a5ab2a239869020ca7fd22c1391fb4a3cc2fd0e9bbb7388c7a8d7580193e54fa5cf4195a2d786e2df0e249b92d26b84a08c88e4b10400e927b59d8e32d93cd0a
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Formbook Payload
-
Suspicious use of SetThreadContext
-