General
-
Target
PaymentXreceipt.pdf.ace
-
Size
526KB
-
Sample
211022-gcar6abbe6
-
MD5
a8849d90ecc227cc4cb889d854b1dc17
-
SHA1
a5f3818f1d33551f19b263b2afd4da88feb95ac9
-
SHA256
76e745479aa92ba3a9d7aa6448aab35758ab2ef7ece2a66d4988bd0cde207771
-
SHA512
c302509b754039b16fa678f3aecc93a459439bddc28709f984741cdd3242bd3f2113145159394f17eabadc71c5325b70c034754845ec2478fb8d58c798d5814a
Malware Config
Extracted
formbook
4.1
mo9n
http://www.lievival.info/mo9n/
circuit-town.com
stock-high.xyz
barlindelivery.com
littletoucans.com
bright-tailor.com
firsthandcares.com
ecompropeller.com
circuitoalberghiero.net
creative-egyptps.com
bitracks56.com
douhonghong.com
fingertipcollection.com
happy-bihada.space
blockchainairdropreward.com
xn--reljame-jwa.com
polloycarnesdelivery.com
d22.group
eslamshahrservice.com
vanzing.com
juzide.com
Targets
-
-
Target
Payment receipt.pdf.exe
-
Size
707KB
-
MD5
d4be4730ee0e801938ae40b02b5ec346
-
SHA1
5a36a50fe19f08f5c34db24127b43bdceb85bb42
-
SHA256
0e6c644f1252507e018b0fbe6b83902adcd2278a083fe1902092f627babf3711
-
SHA512
d4e4a31f6be9df302010ef550191ab5c4f37aaa277e61b88600253ebd8cb7f3a670b13dfd459dc75f88946f78bc2403ca6739d042a6909411bd20dcfda149a29
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Formbook Payload
-
Deletes itself
-
Suspicious use of SetThreadContext
-