General
-
Target
36fb69fb1d2532e631913645983e2e6c41074d72e2cb7ba8fd6748230154c77c
-
Size
1.2MB
-
Sample
220201-vxehqshhgn
-
MD5
daabc1f35c721e74f8fbcdb0043cf3e3
-
SHA1
798c532442394e4fac52a283435c681a1c57f338
-
SHA256
36fb69fb1d2532e631913645983e2e6c41074d72e2cb7ba8fd6748230154c77c
-
SHA512
756e98908102c53a2547b2f8a39bc637469676285bd7a61c0cca50d2fcca816b658a7d24ab87412e85584f7373ea48038369484282a43723998c568908fd5fd5
Malware Config
Extracted
formbook
4.1
ergs
oceanprimesanfrancisco.com
dk-tnc.com
sodangwang.com
abrat-ed.com
dusubiqiqijem.xyz
getsup.online
homeneto.com
shose8.com
tronlane.com
nidowicosasod.xyz
independienteatleticclub.com
pca-winschool.com
realbadnastystories.site
bluevioletfloral.com
simplifiedpeacepodcast.com
abcfreediving.com
theyardbunny.com
holoique.com
ibkr1325.com
tjnfioou.xyz
Targets
-
-
Target
HIPV0170.EXE
-
Size
417KB
-
MD5
abb3147d8c0e9f65b3248004b8fffb91
-
SHA1
127a10da0021ae217648b3636f38d84b8f1459f1
-
SHA256
009e6b48b7d9b2a802d6e831138b1e55c4390861c123287e134bbc21f8a6e225
-
SHA512
af55e007019139a2257815f50f4e1de3fbc6e1fc9195104c989dc6935bc3ec494c2a5900fb56d13fcf1c1a9043659e9c77a7af37b17aec63d9c59a88b9efed02
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Formbook Payload
-
Deletes itself
-
Suspicious use of SetThreadContext
-