General
-
Target
q0M51KeCwlm8dzc.exe
-
Size
412KB
-
Sample
211008-n2lz2seba7
-
MD5
4c2ef8adb226b2cbd30b450ead567e2c
-
SHA1
9ade24a0bf020a4d4e9fea5f4330d5e894e39e21
-
SHA256
2361714a402b085426e5712ff07a8ada008ae9bf76e8ee248cc7ca651c7ac752
-
SHA512
4bd064927193634eab1998118ea8f642b58d4459c668f14affb7c6e7acdef7495de0f28b1d79997ba86f117c3acd2c4cfc89e2e43f6705cd4895f7ebec70ba84
Malware Config
Extracted
formbook
4.1
rv9n
http://www.cjspizza.net/rv9n/
olivia-grace.show
zhuwww.com
keiretsu.xyz
olidnh.space
searuleansec.com
2fastrepair.com
brooklynmetalroof.com
scodol.com
novaprint.pro
the-loaner.com
nextroundscap.com
zbwlggs.com
internetautodealer.com
xn--tornrealestate-ekb.com
yunjiuhuo.com
skandinaviskakryptobanken.com
coxivarag.rest
ophthalmologylab.com
zzzzgjcdbqnn98.net
doeful.com
Targets
-
-
Target
q0M51KeCwlm8dzc.exe
-
Size
412KB
-
MD5
4c2ef8adb226b2cbd30b450ead567e2c
-
SHA1
9ade24a0bf020a4d4e9fea5f4330d5e894e39e21
-
SHA256
2361714a402b085426e5712ff07a8ada008ae9bf76e8ee248cc7ca651c7ac752
-
SHA512
4bd064927193634eab1998118ea8f642b58d4459c668f14affb7c6e7acdef7495de0f28b1d79997ba86f117c3acd2c4cfc89e2e43f6705cd4895f7ebec70ba84
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Formbook Payload
-
Deletes itself
-
Suspicious use of SetThreadContext
-