General
-
Target
yeni sipariş pdf.exe
-
Size
822KB
-
Sample
220207-pjdrdsccc9
-
MD5
41d2899a4441944b48daba79bfb70dd0
-
SHA1
463778a640b327918d8e67cd2f9fa949be3b04e8
-
SHA256
7480e4ba962590b3f14f4516861bb1aa80ffa08223a944ee6599cfe3b4e89bce
-
SHA512
cb5b11e73fb06ffe3e1c4f91658899d82c8da6c6db9f3b3c126840bfb728b6ee862f8b45c903366ab37c2570baff6c298af41f4ffbd92e624579e8c4bc380104
Malware Config
Extracted
formbook
4.1
g2m3
stocktonfingerprinting.com
metaaiqr.com
junicy.com
libertymutualgrou.com
jklhs7gl.xyz
alex-covalcova.space
socialfiguild.com
drnicholasreid.com
androidappprogrammierie.com
relatingtohumans.com
jitsystems.com
gbwpmz.com
lesaventuresdecocomango.com
wu8ggqdv077p.xyz
autnvg.com
wghakt016.xyz
lagosian.store
hilldoor.com
oculos-ajustavel-br.xyz
nameniboothac.com
Targets
-
-
Target
yeni sipariş pdf.exe
-
Size
822KB
-
MD5
41d2899a4441944b48daba79bfb70dd0
-
SHA1
463778a640b327918d8e67cd2f9fa949be3b04e8
-
SHA256
7480e4ba962590b3f14f4516861bb1aa80ffa08223a944ee6599cfe3b4e89bce
-
SHA512
cb5b11e73fb06ffe3e1c4f91658899d82c8da6c6db9f3b3c126840bfb728b6ee862f8b45c903366ab37c2570baff6c298af41f4ffbd92e624579e8c4bc380104
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Formbook Payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Suspicious use of SetThreadContext
-