General
-
Target
PURCHASE ORDER I 5083.exe
-
Size
484KB
-
Sample
210927-jx8k2agacj
-
MD5
d00582b716d424ee1a7cb7b9512a8ae4
-
SHA1
f8db547e1607c97c16f81a68998be1f4d1e2625c
-
SHA256
7e2a14525c0058bca08d945d2358fc629e3080cc111d271253e061a4be0bde17
-
SHA512
bbed76e76b8853163c3d2218d6f7104ca7ee980504a7f75ef95a03857a2a8862370df7ea65fc63c54b3138b0bfb829dc065a9912a4c736deae0322a4105d130a
Malware Config
Extracted
formbook
4.1
ergs
http://www.iselotech.com/ergs/
oceanprimesanfrancisco.com
dk-tnc.com
sodangwang.com
abrat-ed.com
dusubiqiqijem.xyz
getsup.online
homeneto.com
shose8.com
tronlane.com
nidowicosasod.xyz
independienteatleticclub.com
pca-winschool.com
realbadnastystories.site
bluevioletfloral.com
simplifiedpeacepodcast.com
abcfreediving.com
theyardbunny.com
holoique.com
ibkr1325.com
tjnfioou.xyz
Targets
-
-
Target
PURCHASE ORDER I 5083.exe
-
Size
484KB
-
MD5
d00582b716d424ee1a7cb7b9512a8ae4
-
SHA1
f8db547e1607c97c16f81a68998be1f4d1e2625c
-
SHA256
7e2a14525c0058bca08d945d2358fc629e3080cc111d271253e061a4be0bde17
-
SHA512
bbed76e76b8853163c3d2218d6f7104ca7ee980504a7f75ef95a03857a2a8862370df7ea65fc63c54b3138b0bfb829dc065a9912a4c736deae0322a4105d130a
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Formbook Payload
-
Deletes itself
-
Suspicious use of SetThreadContext
-