General
-
Target
b86196be9611b795234dff0f3d10d7d59678288391944190b189ad6fad017882
-
Size
214KB
-
Sample
220505-h9ecaafdc9
-
MD5
a3aee41648e9fa62d3bfd4db586d97ea
-
SHA1
ea6d36b400e9566964bca70e1edeeb0f096059e4
-
SHA256
b86196be9611b795234dff0f3d10d7d59678288391944190b189ad6fad017882
-
SHA512
52f6fcb224a71d0fa6aa0ab207e61b8e694f2f6c1c30d89900235e22f7f84f6ce97f675853c7eb2e5fabf7fc76a13cf030df28cb9b7cb3f10d1f85b2a071088c
Malware Config
Extracted
formbook
4.1
fw02
payer-breakers.com
thesiscoper.com
rental-villa.com
scovikinnovations.com
hydh33.com
allmyshit.rest
lovejaclyn.com
vanessaruizwriting.com
dufonddelaclasse.com
kiddee168.com
monumentalmarketsllc.com
musclegainfatloss.com
avida.info
cosmo-wellness.net
dandelionfusedigital.com
oversizeloadbanners.com
konstelle.store
sdjnsbd.com
czoqg.xyz
5p6xljjse1lq.xyz
Targets
-
-
Target
b86196be9611b795234dff0f3d10d7d59678288391944190b189ad6fad017882
-
Size
214KB
-
MD5
a3aee41648e9fa62d3bfd4db586d97ea
-
SHA1
ea6d36b400e9566964bca70e1edeeb0f096059e4
-
SHA256
b86196be9611b795234dff0f3d10d7d59678288391944190b189ad6fad017882
-
SHA512
52f6fcb224a71d0fa6aa0ab207e61b8e694f2f6c1c30d89900235e22f7f84f6ce97f675853c7eb2e5fabf7fc76a13cf030df28cb9b7cb3f10d1f85b2a071088c
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Formbook Payload
-
Executes dropped EXE
-
Suspicious use of SetThreadContext
-