General
-
Target
PO4502151388.excel.exe
-
Size
310KB
-
Sample
211025-m5p1faghfj
-
MD5
042981e463e96d427fb66d475ff62c17
-
SHA1
588a8cc23b96a5f0c3744729f114b67da78bf183
-
SHA256
d2b2d54f03ed22179f9317d2c7bfbcdf669e1378a35727cde4147ac41f669dd1
-
SHA512
6aded5d389779bafc5dabae3b7d589d67e4a0b7fa3cacccf3191aa518e6c5416ac216c6d24855cc6cdb5c387f25e924acdf02e09831d8e76218b31d5c717ef32
Static task
static1
Behavioral task
behavioral1
Sample
PO4502151388.excel.exe
Resource
win7-en-20211014
Malware Config
Extracted
formbook
4.1
ct6s
http://www.metalzj.quest/ct6s/
liaquatsibtian.com
erisa.cymru
theultimateone.world
petpartner.info
edison-press.com
ryanmurazik.icu
bukasystems.com
kitsusimplex.com
qatarstyleart.com
brkhot.top
paehdfdtrujdfhs.xyz
createdbybonk.com
kuihoon.com
deathtocustomerservice.com
iotimb.com
greendiamond.pw
millionaireproducers.academy
websitemolsa.com
cbshomeimprovement.com
eardunder.quest
qdsrogijnsoiaha.xyz
winsimplebet8.com
nguyendinhmanh.online
straforkutu.online
jtbfunnels.xyz
sz-videocom.com
budteeshirts.com
teinkstash.com
aohuajz.com
awcarsales.com
thankful.love
yukselfirca.com
gamblz.com
prologuepr.com
georgemanuel.com
crewcamel.team
digesters.info
diosaempoderada.com
pobbs65.xyz
monoscribe.com
kelseycoding.com
lauertmouku.quest
techtalks-2021.com
zhi2021.com
bslf.xyz
socialdiseaseshop.com
bsnguyenhuunam.com
glozhair.com
pieko.net
hirenearyou.com
xoarin.online
beyondracula.com
hoshikoblog1.com
bigbet2298.com
pricetrust-shop.com
afiliadosilva.com
alrayangroups.com
sittingonforgis.online
fiitnutr.com
killeendirectconnection.com
princesstvchannels.com
belleshopdz.com
vanillanoir.com
homodont.com
Targets
-
-
Target
PO4502151388.excel.exe
-
Size
310KB
-
MD5
042981e463e96d427fb66d475ff62c17
-
SHA1
588a8cc23b96a5f0c3744729f114b67da78bf183
-
SHA256
d2b2d54f03ed22179f9317d2c7bfbcdf669e1378a35727cde4147ac41f669dd1
-
SHA512
6aded5d389779bafc5dabae3b7d589d67e4a0b7fa3cacccf3191aa518e6c5416ac216c6d24855cc6cdb5c387f25e924acdf02e09831d8e76218b31d5c717ef32
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Formbook Payload
-
Deletes itself
-
Loads dropped DLL
-
Suspicious use of SetThreadContext
-