General
-
Target
trail order x catalogue.xlsx
-
Size
229KB
-
Sample
211206-hbjjcagcb5
-
MD5
6c823e6765883e7a609a60bb2539e66c
-
SHA1
fee1d36f9551818eb5fa6df9bb9272ac921ffa85
-
SHA256
1a70803889b33f746970ba8d071d74f840b60d9573407f0a39fa9d2112c0acea
-
SHA512
f00fca6c461993b03ac1d53a5a2a6fa6d294d4dbaa4c91790a53c883168a2e1396f429d84ab2c62e7cd484df93663ee16830888ffe35c443fa510363cd13767b
Malware Config
Extracted
formbook
4.1
9gr5
http://www.cuteprofessionalscrubs.com/9gr5/
newleafcosmetix.com
richermanscastle.com
ru-remonton.com
2diandongche.com
federaldados.design
jeffreycookweb.com
facecs.online
xmeclarn.xyz
olgasmith.xyz
sneakersonlinesale.com
playboyshiba.com
angelamiglioli.com
diitaldefynd.com
whenevergames.com
mtheartcustom.com
vitalactivesupply.com
twistblogr.com
xn--i8s140at3d6u7c.tel
baudelaireelhakim.com
real-estate-miami-searcher.site
Targets
-
-
Target
trail order x catalogue.xlsx
-
Size
229KB
-
MD5
6c823e6765883e7a609a60bb2539e66c
-
SHA1
fee1d36f9551818eb5fa6df9bb9272ac921ffa85
-
SHA256
1a70803889b33f746970ba8d071d74f840b60d9573407f0a39fa9d2112c0acea
-
SHA512
f00fca6c461993b03ac1d53a5a2a6fa6d294d4dbaa4c91790a53c883168a2e1396f429d84ab2c62e7cd484df93663ee16830888ffe35c443fa510363cd13767b
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Formbook Payload
-
Blocklisted process makes network request
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Loads dropped DLL
-
Uses the VBS compiler for execution
-
Suspicious use of SetThreadContext
-