General
-
Target
4e985458976378ce5866b7631c0bd0ecf259d246b3c9b7f6e12b144efcf855b8
-
Size
173KB
-
Sample
220118-vjxgdscbd9
-
MD5
26c5dc4002976b3b9ae49f2440929df4
-
SHA1
e43a8d51eacb148ed0cfa2d88b229bf212493eab
-
SHA256
4e985458976378ce5866b7631c0bd0ecf259d246b3c9b7f6e12b144efcf855b8
-
SHA512
a3789050060c85a77c48631ec7ab564d0244b49c4e513a388f7f2fbd57a1ad669ffa21b1c87a18daeb4655fe964906c92269dd461c18269fff4660adc5ef188d
Malware Config
Extracted
formbook
4.1
oh75
denizgidam.com
6cc06.com
charlottewaldburgzeil.com
medijanus.com
qingdaoyiersan.com
datcabilgisayar.xyz
111439d.com
xn--1ruo40k.com
wu6enxwcx5h3.xyz
vnscloud.net
brtka.xyz
showztime.com
promocoesdedezenbro.com
wokpy.com
chnowuk.online
rockshotscafe.com
pelrjy.com
nato-riness.com
feixiang-chem.com
thcoinexchange.com
Targets
-
-
Target
4e985458976378ce5866b7631c0bd0ecf259d246b3c9b7f6e12b144efcf855b8
-
Size
173KB
-
MD5
26c5dc4002976b3b9ae49f2440929df4
-
SHA1
e43a8d51eacb148ed0cfa2d88b229bf212493eab
-
SHA256
4e985458976378ce5866b7631c0bd0ecf259d246b3c9b7f6e12b144efcf855b8
-
SHA512
a3789050060c85a77c48631ec7ab564d0244b49c4e513a388f7f2fbd57a1ad669ffa21b1c87a18daeb4655fe964906c92269dd461c18269fff4660adc5ef188d
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Formbook Payload
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-