General
-
Target
PO_A9164.EXE
-
Size
428KB
-
Sample
211004-hfsyksgaeq
-
MD5
5ccd1492d563b11ffdfd66d51aa370b5
-
SHA1
3a7441cb83f5ca0732e8826f164c087b077a69a5
-
SHA256
e777d588f24e21fdcc3add6de5b93d5fb498b594a59f03d02b5a7880bc5d5180
-
SHA512
11625c6391526fd798ed1d22b8df9a5278241b4b2ec0e37d1d8493ef5a7f1fad4f4d850c67713a431d38739a43d5b7e88394dc039de49ae986e7b215be2f5444
Malware Config
Extracted
formbook
4.1
ergs
http://www.iselotech.com/ergs/
oceanprimesanfrancisco.com
dk-tnc.com
sodangwang.com
abrat-ed.com
dusubiqiqijem.xyz
getsup.online
homeneto.com
shose8.com
tronlane.com
nidowicosasod.xyz
independienteatleticclub.com
pca-winschool.com
realbadnastystories.site
bluevioletfloral.com
simplifiedpeacepodcast.com
abcfreediving.com
theyardbunny.com
holoique.com
ibkr1325.com
tjnfioou.xyz
Targets
-
-
Target
PO_A9164.EXE
-
Size
428KB
-
MD5
5ccd1492d563b11ffdfd66d51aa370b5
-
SHA1
3a7441cb83f5ca0732e8826f164c087b077a69a5
-
SHA256
e777d588f24e21fdcc3add6de5b93d5fb498b594a59f03d02b5a7880bc5d5180
-
SHA512
11625c6391526fd798ed1d22b8df9a5278241b4b2ec0e37d1d8493ef5a7f1fad4f4d850c67713a431d38739a43d5b7e88394dc039de49ae986e7b215be2f5444
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Formbook Payload
-
Deletes itself
-
Suspicious use of SetThreadContext
-