General
-
Target
TURKEY ORDER .scr
-
Size
503KB
-
Sample
220131-lmmlxsghgj
-
MD5
8d97825fcb618d066758c26345a0e1a7
-
SHA1
75cd534c1749636a42275ba79e47cffa45d238c0
-
SHA256
c9d9d795f4da4b011059eefc991e9e0790df60b47a992973b56a4261dbe943a5
-
SHA512
1a4caac07969533aff4f10a3af56cb2b3437b65e1776bcf8c36168ffa721f8acd928ee053079a71c106ccca664d3407d45005b71e18c3ae7909be4028d3f58cc
Malware Config
Extracted
formbook
4.1
s16r
kellieroysellsnc.com
valleylowvoltage.com
mltuo900.xyz
visitingpuntacana.com
weiwushi.com
austintechjob.com
rxstarcbd.com
shopstudioesi.com
filetto-server.xyz
relianceltdbnk.com
unethical.world
yedd.store
esthershhs.com
magaddis.com
scenicdrivetours.com
123gest.com
2020mortagelifeinsurance.com
faceinle.com
integritymarking.com
alfatoto.xyz
Targets
-
-
Target
TURKEY ORDER .scr
-
Size
503KB
-
MD5
8d97825fcb618d066758c26345a0e1a7
-
SHA1
75cd534c1749636a42275ba79e47cffa45d238c0
-
SHA256
c9d9d795f4da4b011059eefc991e9e0790df60b47a992973b56a4261dbe943a5
-
SHA512
1a4caac07969533aff4f10a3af56cb2b3437b65e1776bcf8c36168ffa721f8acd928ee053079a71c106ccca664d3407d45005b71e18c3ae7909be4028d3f58cc
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Formbook Payload
-
Deletes itself
-
Suspicious use of SetThreadContext
-