General
-
Target
o.exe
-
Size
188KB
-
Sample
220127-qxr2lsdecq
-
MD5
5f625c29e0ab782363acad948b13374f
-
SHA1
af2cb912c0d8c6eb43ade7940dbb56815d9c79a6
-
SHA256
e38ab4998d2ec00aef052328a9a289a9a96ab45fb52a49b81a223068b0f5899c
-
SHA512
ec409199c648bf6feec2eda0b00b959384a72942f7a3451a9e5a2889e7250b9595a765a0d4fc4cd2a8a2d8e9884d3bc4610cdc2d9cf538a945371f5a07cdabe5
Malware Config
Extracted
formbook
4.1
je16
antonavt.com
sdfvlog.xyz
xn--arbetslivsaktren-ywb.com
propelcolor.com
uniqueclsssiccars.com
colorbells.com
synjive.com
cloudymellows.com
walltage.com
qterps.com
kezorup.online
soakedindelight.online
thefirstgroupscam.biz
miclanka.com
mwm-security.com
trinksaifenradiodocumentary.com
spineklinik.com
javacodecafe.com
groovyrelease-toknowtoday.info
ventadesillasymesas.com
Targets
-
-
Target
o.exe
-
Size
188KB
-
MD5
5f625c29e0ab782363acad948b13374f
-
SHA1
af2cb912c0d8c6eb43ade7940dbb56815d9c79a6
-
SHA256
e38ab4998d2ec00aef052328a9a289a9a96ab45fb52a49b81a223068b0f5899c
-
SHA512
ec409199c648bf6feec2eda0b00b959384a72942f7a3451a9e5a2889e7250b9595a765a0d4fc4cd2a8a2d8e9884d3bc4610cdc2d9cf538a945371f5a07cdabe5
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Formbook Payload
-
Deletes itself
-
Suspicious use of SetThreadContext
-