General
-
Target
neworder.xlsx
-
Size
229KB
-
Sample
211117-j5ktyaefgp
-
MD5
3b26583e226ee913636bfc612327560b
-
SHA1
419df1d3da4ab66a8a72c783a87aed90baf2fa6f
-
SHA256
d80780ff5af7a166070fa5608c29ff736ff1357349b3784eab3b05de71239184
-
SHA512
90b0407fbd934b1a68d1471dfb51fa590a999619c734ce3950a4afd5318761928a53f11ac38ef97e05c4e078c2b353ae8ec36df8ccf2a2d0ac266bfd76f9a2c5
Malware Config
Extracted
formbook
4.1
9gr5
http://www.cuteprofessionalscrubs.com/9gr5/
newleafcosmetix.com
richermanscastle.com
ru-remonton.com
2diandongche.com
federaldados.design
jeffreycookweb.com
facecs.online
xmeclarn.xyz
olgasmith.xyz
sneakersonlinesale.com
playboyshiba.com
angelamiglioli.com
diitaldefynd.com
whenevergames.com
mtheartcustom.com
vitalactivesupply.com
twistblogr.com
xn--i8s140at3d6u7c.tel
baudelaireelhakim.com
real-estate-miami-searcher.site
Targets
-
-
Target
neworder.xlsx
-
Size
229KB
-
MD5
3b26583e226ee913636bfc612327560b
-
SHA1
419df1d3da4ab66a8a72c783a87aed90baf2fa6f
-
SHA256
d80780ff5af7a166070fa5608c29ff736ff1357349b3784eab3b05de71239184
-
SHA512
90b0407fbd934b1a68d1471dfb51fa590a999619c734ce3950a4afd5318761928a53f11ac38ef97e05c4e078c2b353ae8ec36df8ccf2a2d0ac266bfd76f9a2c5
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
-
Formbook Payload
-
Blocklisted process makes network request
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Loads dropped DLL
-
Uses the VBS compiler for execution
-
Suspicious use of SetThreadContext
-