General
-
Target
Pywofcgeqebadvfrqnascbjqjrjuompfxk.exe
-
Size
788KB
-
Sample
220116-w3hb9agbeq
-
MD5
6616838e56173d87612636d63797a3d8
-
SHA1
8b12d9623c74bdee8b4c18f9c88a7667618ec64c
-
SHA256
468f20a351d3ca67038276934cb154c856d06a707e28feda2f64d6770bc93302
-
SHA512
16645b97991b3ce4d1c9297823407c1c759d5a39511aa174ccb40544f433175f759369c2ad81e2f85b6fb288bc89b152129fb4f390a11909eb542c00b0cddb81
Malware Config
Extracted
formbook
4.1
gmfe
boldaerospace.com
oleeoe.com
aucreuxducoeur.one
fatbellytonic.com
newfrontiermining.net
iphone13promax.guide
meltingpotspot.com
zuinigerijder.com
sigmagrup.com
thehekadivine.com
once-only.online
variouselectricianservice.com
xn--oy2b9rj5qfzo85aro.com
wuzuiso.com
inoutinsurance.xyz
company-intel.net
apppromaguginybuo.com
st666.tech
k-reborn-okayama.com
realteenpattix.com
Targets
-
-
Target
Pywofcgeqebadvfrqnascbjqjrjuompfxk.exe
-
Size
788KB
-
MD5
6616838e56173d87612636d63797a3d8
-
SHA1
8b12d9623c74bdee8b4c18f9c88a7667618ec64c
-
SHA256
468f20a351d3ca67038276934cb154c856d06a707e28feda2f64d6770bc93302
-
SHA512
16645b97991b3ce4d1c9297823407c1c759d5a39511aa174ccb40544f433175f759369c2ad81e2f85b6fb288bc89b152129fb4f390a11909eb542c00b0cddb81
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Formbook Payload
-
ModiLoader First Stage
-
Executes dropped EXE
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-