General
-
Target
cfa42383596eaed1eff9a35af295930c2e26615a12249041b5d291416d89c8a6
-
Size
214KB
-
Sample
220504-hts6hafhcn
-
MD5
3f54e149af6d9802c9a03de4157c7621
-
SHA1
8ba2e29b8ef74315f335d7ca666ec56accd80d8d
-
SHA256
cfa42383596eaed1eff9a35af295930c2e26615a12249041b5d291416d89c8a6
-
SHA512
4f1401b2cac5d3dbda82ffc7c96151401578b3bb592b7b48caee5e362cb458a77b4e701816a3f88dc6db76c731dff53305d1430c6ab594940ac5706c211c0713
Malware Config
Extracted
formbook
4.1
fw02
payer-breakers.com
thesiscoper.com
rental-villa.com
scovikinnovations.com
hydh33.com
allmyshit.rest
lovejaclyn.com
vanessaruizwriting.com
dufonddelaclasse.com
kiddee168.com
monumentalmarketsllc.com
musclegainfatloss.com
avida.info
cosmo-wellness.net
dandelionfusedigital.com
oversizeloadbanners.com
konstelle.store
sdjnsbd.com
czoqg.xyz
5p6xljjse1lq.xyz
Targets
-
-
Target
cfa42383596eaed1eff9a35af295930c2e26615a12249041b5d291416d89c8a6
-
Size
214KB
-
MD5
3f54e149af6d9802c9a03de4157c7621
-
SHA1
8ba2e29b8ef74315f335d7ca666ec56accd80d8d
-
SHA256
cfa42383596eaed1eff9a35af295930c2e26615a12249041b5d291416d89c8a6
-
SHA512
4f1401b2cac5d3dbda82ffc7c96151401578b3bb592b7b48caee5e362cb458a77b4e701816a3f88dc6db76c731dff53305d1430c6ab594940ac5706c211c0713
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Formbook Payload
-
Executes dropped EXE
-
Suspicious use of SetThreadContext
-