General
-
Target
p2.exe
-
Size
678KB
-
Sample
211015-mhnh4aage8
-
MD5
5d0d79406f8e894b3146ecbbf8e27465
-
SHA1
cdad223f57b289f0a31df86dc254e13325289f6b
-
SHA256
e36594f316d20c3f0fb948a9c12a0190b872265c7ba49ebb4ffab701f38bbdd9
-
SHA512
169da8773ca03edbe2ece9614f789d331c6a3732e70d535afb423c133d7c56d90af42409e3fd58d4a5ccf955fce0ff2c400c4d3bfb9af6af110ee69206970c3c
Malware Config
Extracted
formbook
4.1
n7ak
http://www.kmresults.com/n7ak/
modischoolcbse.com
theneverwinter.com
rszkjx-vps-hosting.website
fnihil.com
1pbet.com
nnowzscorrez.com
uaotgvjl.icu
starmapsqatar.com
ekisilani.com
extradeepsheets.com
jam-nins.com
buranly.com
orixentertainment.com
rawtech.energy
myol.guru
utex.club
jiapie.com
wowig.store
wweidlyyl.com
systaskautomation.com
Targets
-
-
Target
p2.exe
-
Size
678KB
-
MD5
5d0d79406f8e894b3146ecbbf8e27465
-
SHA1
cdad223f57b289f0a31df86dc254e13325289f6b
-
SHA256
e36594f316d20c3f0fb948a9c12a0190b872265c7ba49ebb4ffab701f38bbdd9
-
SHA512
169da8773ca03edbe2ece9614f789d331c6a3732e70d535afb423c133d7c56d90af42409e3fd58d4a5ccf955fce0ff2c400c4d3bfb9af6af110ee69206970c3c
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Formbook Payload
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-