General
-
Target
9.exe
-
Size
188KB
-
Sample
211124-tdbr3adahr
-
MD5
dac650b23c4aba94eaf5caaeead3319c
-
SHA1
229458c66c9555a3d61ae980708357f093c5e6b8
-
SHA256
bc8cabab3ec65da43b8c3e708ed9f9745757523041ef62e450b6fea48fae50e1
-
SHA512
a6cdb8b8944686f87afb3763d37774d98b4f05ad7ee694490d67c4e00f007ffab33b02f006b0e782ee67be085b97183d0020181621d879c80463669efd407bb5
Malware Config
Extracted
formbook
4.1
w6ya
http://www.truth-capturemachine.com/w6ya/
auden-audio.com
zombieodyssey.com
hdpthg.com
toddtechnical.com
njsdgz.com
yieldfarm.world
guardsveirfynews.net
atmamandir.info
eskisehirtostcusu.online
arrozz.net
v99king.win
jaxonboxing.com
morganevans.net
syandeg.com
valleyofplants.com
corsosportorico.com
tak.support
blacktgpc.com
herdpetshop.com
iifkvhns.xyz
Targets
-
-
Target
9.exe
-
Size
188KB
-
MD5
dac650b23c4aba94eaf5caaeead3319c
-
SHA1
229458c66c9555a3d61ae980708357f093c5e6b8
-
SHA256
bc8cabab3ec65da43b8c3e708ed9f9745757523041ef62e450b6fea48fae50e1
-
SHA512
a6cdb8b8944686f87afb3763d37774d98b4f05ad7ee694490d67c4e00f007ffab33b02f006b0e782ee67be085b97183d0020181621d879c80463669efd407bb5
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Formbook Payload
-
Deletes itself
-
Suspicious use of SetThreadContext
-