General
-
Target
Orden-012.zip
-
Size
241KB
-
Sample
210925-dkyx6sacep
-
MD5
f1c2d495457283a7ab9006e19e79f829
-
SHA1
212b3a8d2574a7de3768929588a26b6d45d36aff
-
SHA256
5e8badba056a2df1a7e00b71f66b34e7ab74922853b5080b883fcd02df8ba12a
-
SHA512
a34ee613b326d9fb1212576a369975b497d9898eeb602fe47698fa2a83548f4be9ad8bf2318497677cb808e71e84c476675ed0580f7f01f383c12d791b4970cc
Malware Config
Extracted
formbook
4.1
dn7r
http://www.yourherogarden.net/dn7r/
eventphotographerdfw.com
thehalalcoinstaking.com
philipfaziofineart.com
intercoh.com
gaiaseyephotography.com
chatbotforrealestate.com
lovelancemg.com
marlieskasberger.com
elcongoenespanol.info
lepirecredit.com
distribution-concept.com
e99game.com
exit11festival.com
twodollartoothbrushclub.com
cocktailsandlawn.com
performimprove.network
24horas-telefono-11840.com
cosmossify.com
kellenleote.com
perovskite.energy
Targets
-
-
Target
Orde.exe
-
Size
253KB
-
MD5
3bb9e36eafb639d7e69659d549de50d2
-
SHA1
980383664a8dafa46990f23180330f5c805a14ce
-
SHA256
22a12f1f1043bd45a4579e40fded8f79fe405142c3306636480e13038ba59552
-
SHA512
01e5e3c8f22b7a8a3268ac5a082ea0ccb199a19d9a823652b74f4b1fa49ff17163542ed9b524261d24d70e3d585a3cd5e111d103ac81c697d6a5de442bf2c519
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Formbook Payload
-
Loads dropped DLL
-
Suspicious use of SetThreadContext
-