General
-
Target
001100202021.lzh
-
Size
384KB
-
Sample
211102-pvmhnshedn
-
MD5
8b2f379ffe86b4ad0ef434942b512d8e
-
SHA1
0774a83d385d18253d0f6e7b02a3699af20c443b
-
SHA256
7b2d58fc166483d629c34ce43755517784fd00eb691aec1037e333f3759fcf49
-
SHA512
ccde975745d4faeeb58bc38be4f1641dc1a99b0e2e62abe6e1ab597bcacd7c4b437555dca8aff782d3e81c958c84cf4d6ed3b4b61ad855b1ca2b993ff997dc2f
Malware Config
Extracted
formbook
4.1
u1bs
http://www.vgmpradio.com/u1bs/
ln-safe-keepingmisva4.xyz
rtfh.xyz
awolin.link
metadlf.com
cardboardcasual.com
psicoterapiahablada.com
spaminator.xyz
hnjqzl.top
dentalyinovasi.site
biosynblas.com
zvyk.store
shreevishwakarmaservices.com
showersplash.com
norbert-roth.com
londoncapitaltraders.com
istanbuldonerkebabheroncity.com
realdiscountsnow.com
marlinplumbingwnc.com
magazinadziavane.com
qantv.com
Targets
-
-
Target
001100202021.exe
-
Size
462KB
-
MD5
54c9006a6634870e0f02fca2b6ba0d4f
-
SHA1
7a3fffad9a7be88516c8004e9e6b55fcf4757e35
-
SHA256
62678459c076b6993bbe9cc617bde236afe8a87906f5de98adc375665ba0a84f
-
SHA512
295ccdd3a3ff79957d559d9cdb9a8d8f2d6fbf471667516a03e0a127395ad33927e3b80f0245229a208fe1460a4def93542b551e1eb5bb5cf0cd428a59f7f697
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Formbook Payload
-
Deletes itself
-
Suspicious use of SetThreadContext
-