General
-
Target
Amended SO of 2000KVA400KVA.exe
-
Size
749KB
-
Sample
210922-qag8wscfd3
-
MD5
55552a34489fa2cf62cac5667e17cd45
-
SHA1
0292df2a71fbeed972ad72e29d42c4fd71469372
-
SHA256
410659d6e76a955d58e88df12ffea3550a57758513630f051c6e66caa343fdad
-
SHA512
5c22f59cb3819ab0230043bb27de9c134872c316a998e1e08d1bb3653f00310327b821dea128ee021fcbb4a6ee1e33fdc539606c5a13f7099977808be575ecae
Malware Config
Extracted
formbook
4.1
ergs
http://www.iselotech.com/ergs/
oceanprimesanfrancisco.com
dk-tnc.com
sodangwang.com
abrat-ed.com
dusubiqiqijem.xyz
getsup.online
homeneto.com
shose8.com
tronlane.com
nidowicosasod.xyz
independienteatleticclub.com
pca-winschool.com
realbadnastystories.site
bluevioletfloral.com
simplifiedpeacepodcast.com
abcfreediving.com
theyardbunny.com
holoique.com
ibkr1325.com
tjnfioou.xyz
Targets
-
-
Target
Amended SO of 2000KVA400KVA.exe
-
Size
749KB
-
MD5
55552a34489fa2cf62cac5667e17cd45
-
SHA1
0292df2a71fbeed972ad72e29d42c4fd71469372
-
SHA256
410659d6e76a955d58e88df12ffea3550a57758513630f051c6e66caa343fdad
-
SHA512
5c22f59cb3819ab0230043bb27de9c134872c316a998e1e08d1bb3653f00310327b821dea128ee021fcbb4a6ee1e33fdc539606c5a13f7099977808be575ecae
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Formbook Payload
-
Blocklisted process makes network request
-
Suspicious use of SetThreadContext
-