General
-
Target
9261cdcf86933da34b74afa3da380bc3.exe
-
Size
1.1MB
-
Sample
211019-svrn6sgba6
-
MD5
9261cdcf86933da34b74afa3da380bc3
-
SHA1
e14a6cc8f298e10b5eb7b9f56058efc4734ae3a3
-
SHA256
42e09f0e4d7ab0448e04d5d31fbc63cfb2df988f848853a5a149ff5454040184
-
SHA512
1a895493a230e678b4bb756aa5ccb24fd6d0e097c462605b6b4759674a7510fa566b00f018a48e7d6b3cbd1cee61ba1e1ef869b7de8e77f948f80e8797912d3a
Malware Config
Extracted
formbook
4.1
og2w
http://www.wakecountyrealtyexpert.com/og2w/
patriotxf.com
thecreagles.com
riverdenim.com
cybqo.com
zzfangnan.com
empowerhis.com
resiliencewearmiami.com
myticketly.com
pistachio.land
13055.club
millennialsofacertainage.com
jnxdsgc.com
pixelsandplastic.digital
bugroster.com
chargedockz.com
gzyazsp.com
sintec-consultores.com
pourtonmobile.com
upmhss.com
amkanalrajhi.com
Targets
-
-
Target
9261cdcf86933da34b74afa3da380bc3.exe
-
Size
1.1MB
-
MD5
9261cdcf86933da34b74afa3da380bc3
-
SHA1
e14a6cc8f298e10b5eb7b9f56058efc4734ae3a3
-
SHA256
42e09f0e4d7ab0448e04d5d31fbc63cfb2df988f848853a5a149ff5454040184
-
SHA512
1a895493a230e678b4bb756aa5ccb24fd6d0e097c462605b6b4759674a7510fa566b00f018a48e7d6b3cbd1cee61ba1e1ef869b7de8e77f948f80e8797912d3a
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Formbook Payload
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-