General
-
Target
8e4ca12811ae20874923d590e85c6e0a4c591fa3dfe754cce7c47433b713b9c8
-
Size
179KB
-
Sample
220123-1pkmnsgeb4
-
MD5
d1e3fd66ad9d3f486ada819177faa8c6
-
SHA1
59cece6df8422b80b4a8e93199584fb73ab36f23
-
SHA256
8e4ca12811ae20874923d590e85c6e0a4c591fa3dfe754cce7c47433b713b9c8
-
SHA512
e83987e3af799aa32ca8368da86707699c3a41ec781f85292d7e410f92ef407d7f049a47d87ad645de21d1efb828dee42bd260b35e0f9ae95d84462f84e1905f
Malware Config
Extracted
formbook
4.1
oh75
denizgidam.com
6cc06.com
charlottewaldburgzeil.com
medijanus.com
qingdaoyiersan.com
datcabilgisayar.xyz
111439d.com
xn--1ruo40k.com
wu6enxwcx5h3.xyz
vnscloud.net
brtka.xyz
showztime.com
promocoesdedezenbro.com
wokpy.com
chnowuk.online
rockshotscafe.com
pelrjy.com
nato-riness.com
feixiang-chem.com
thcoinexchange.com
Targets
-
-
Target
8e4ca12811ae20874923d590e85c6e0a4c591fa3dfe754cce7c47433b713b9c8
-
Size
179KB
-
MD5
d1e3fd66ad9d3f486ada819177faa8c6
-
SHA1
59cece6df8422b80b4a8e93199584fb73ab36f23
-
SHA256
8e4ca12811ae20874923d590e85c6e0a4c591fa3dfe754cce7c47433b713b9c8
-
SHA512
e83987e3af799aa32ca8368da86707699c3a41ec781f85292d7e410f92ef407d7f049a47d87ad645de21d1efb828dee42bd260b35e0f9ae95d84462f84e1905f
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Formbook Payload
-
Executes dropped EXE
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-