General
-
Target
0bfad235516b2334cb08d5a91165ab3cdbbf0dc40caa8cc51a8c80308b78c878
-
Size
1.2MB
-
Sample
220509-a1jlmsegal
-
MD5
a96b7c63e619507c2e2f0d6578c64a04
-
SHA1
8901dbed4ad6f73fc0a9ba1682bbffb6808e429f
-
SHA256
0bfad235516b2334cb08d5a91165ab3cdbbf0dc40caa8cc51a8c80308b78c878
-
SHA512
0dfe34d046341545a468e842d7df09a386fff1e96fc1f4d400a6c47c5a73dd9ca5ac0655087fe4ee078aee81d7b993499a3c2360d503020cd5ab05bb9c6b02e1
Malware Config
Extracted
formbook
4.1
3nop
bakecakesandmore.com
shenglisuoye.com
chinapopfactory.com
ynlrhd.com
liqourforyou.com
leonqamil.com
meccafon.com
online-marketing-strategie.biz
rbfxi.com
frseyb.info
leyu91.com
hotsmail.today
beepot.tech
dunaemmetmobility.com
sixpenceworkshop.com
incrediblefavorcoaching.com
pofo.info
yanshudaili.com
yellowbrickwedding.com
paintpartyblueprint.com
Targets
-
-
Target
0bfad235516b2334cb08d5a91165ab3cdbbf0dc40caa8cc51a8c80308b78c878
-
Size
1.2MB
-
MD5
a96b7c63e619507c2e2f0d6578c64a04
-
SHA1
8901dbed4ad6f73fc0a9ba1682bbffb6808e429f
-
SHA256
0bfad235516b2334cb08d5a91165ab3cdbbf0dc40caa8cc51a8c80308b78c878
-
SHA512
0dfe34d046341545a468e842d7df09a386fff1e96fc1f4d400a6c47c5a73dd9ca5ac0655087fe4ee078aee81d7b993499a3c2360d503020cd5ab05bb9c6b02e1
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Formbook Payload
-
Drops startup file
-
Suspicious use of SetThreadContext
-