General
-
Target
pos.gz
-
Size
393KB
-
Sample
211021-q7jszsadd6
-
MD5
528df72de56beb8f660d790be5b2530b
-
SHA1
d13732bc44485ffe210f8a3569c1aba362ad3d61
-
SHA256
a5e9691e534dca4edb6c0a0e86690541c9ec6f4f17bb4b0114c4045bc2e0b79b
-
SHA512
9f4a3097d11f58edfa1543cf73e32c51e77f75f866b8e48580bbbc42cdb1003379ee1442d24dff899608eb79abdcf2721ac2b42caa5ff0f24e3009402dbbfdf1
Malware Config
Extracted
formbook
4.1
u1bs
http://www.vgmpradio.com/u1bs/
ln-safe-keepingmisva4.xyz
rtfh.xyz
awolin.link
metadlf.com
cardboardcasual.com
psicoterapiahablada.com
spaminator.xyz
hnjqzl.top
dentalyinovasi.site
biosynblas.com
zvyk.store
shreevishwakarmaservices.com
showersplash.com
norbert-roth.com
londoncapitaltraders.com
istanbuldonerkebabheroncity.com
realdiscountsnow.com
marlinplumbingwnc.com
magazinadziavane.com
qantv.com
Targets
-
-
Target
pos.exe
-
Size
454KB
-
MD5
0082bb1c3ac5dc499f6db3d45de0ab3e
-
SHA1
90eb55324f4068a4fde1da25ca7a3eff65d17e1e
-
SHA256
1bb913d6f594107a8c8d4d64f9a3de85c602813d9ad93189b9949fbc8a93aa32
-
SHA512
e42c5af62527c2193d3f49f93918535b656f9d0a34065657df8273e606405b551e9f939450a134c20c58429951fbe7a27c14e19e66eeee57446349eaf7e30384
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Formbook Payload
-
Deletes itself
-
Suspicious use of SetThreadContext
-