General
-
Target
b26d7f1c78311fe2e149042bbfeb9b14781de9e7dfd3bcb1e78ec540fe316ad6
-
Size
1.2MB
-
Sample
220201-tvdmzshgd3
-
MD5
71855311af9db1549bd4f9a580196a57
-
SHA1
b0f2f9c5a5d463118e27751acba702d16850f8c5
-
SHA256
b26d7f1c78311fe2e149042bbfeb9b14781de9e7dfd3bcb1e78ec540fe316ad6
-
SHA512
0f1dea1769f4000965301f269a54c2fc2be7c275abc98211169c384a9a3260d71601245595f608c6d2d761127899ab291c5648d91af7fc86b86d8a22e2f7d6ed
Malware Config
Extracted
formbook
4.1
ergs
oceanprimesanfrancisco.com
dk-tnc.com
sodangwang.com
abrat-ed.com
dusubiqiqijem.xyz
getsup.online
homeneto.com
shose8.com
tronlane.com
nidowicosasod.xyz
independienteatleticclub.com
pca-winschool.com
realbadnastystories.site
bluevioletfloral.com
simplifiedpeacepodcast.com
abcfreediving.com
theyardbunny.com
holoique.com
ibkr1325.com
tjnfioou.xyz
Targets
-
-
Target
PO_A9164.EXE
-
Size
428KB
-
MD5
5ccd1492d563b11ffdfd66d51aa370b5
-
SHA1
3a7441cb83f5ca0732e8826f164c087b077a69a5
-
SHA256
e777d588f24e21fdcc3add6de5b93d5fb498b594a59f03d02b5a7880bc5d5180
-
SHA512
11625c6391526fd798ed1d22b8df9a5278241b4b2ec0e37d1d8493ef5a7f1fad4f4d850c67713a431d38739a43d5b7e88394dc039de49ae986e7b215be2f5444
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Formbook Payload
-
Deletes itself
-
Suspicious use of SetThreadContext
-