General
-
Target
15ac04ec28d56ae025739eb61733b091ce0c6ea9498eca607c07e2f71c702df1
-
Size
194KB
-
Sample
220521-mmfdaafbdq
-
MD5
4c14e5f104fe6a299773d4b4399c91c9
-
SHA1
7e1e41e7e29a66c20263c1508b822b2c7675af6a
-
SHA256
15ac04ec28d56ae025739eb61733b091ce0c6ea9498eca607c07e2f71c702df1
-
SHA512
86843e971de5031e57ff1638283171197f00afaa632a6c225c7bc3d39475ee7c620e47957ef5e8259a7a30525ba8499c8d5c969283ff9aebd7bfa593401f3049
Static task
static1
Behavioral task
behavioral1
Sample
RFQ_TMZ14062020.exe
Resource
win7-20220414-en
Malware Config
Extracted
formbook
4.1
b0y
studiokopa.net
captaindoggo.net
project-woodwork.com
lasvegaskosher.com
elionimali.com
cozystylekobe.com
baiyizhao.com
djaimevargas.com
getshop.today
chikkadee.com
historicnortherncolorado.com
artofbrandstorytelling.com
robinsonscommunitiesph.com
petfriendlyrentals.net
dolphinsdragonsanddinsoaurs.com
phucquangphat.com
charitydigitalnetworks.com
czhuiyue.com
thetripletwomethod.com
harvestexcitementonline.info
journeytonothing.com
fanwoodnjautorepairshop.com
alicegaetano.com
soicauxs88.com
ig-talent.com
orsens-massage.com
michaelreevessoftware.com
mhkjc.com
wg9966.com
jlovecash.com
scambiolibri.online
computerrepairasap.com
frontroombingo.com
pcpvusffuf.men
neoconstruction-comores.com
phnixusa.net
baicheng.ltd
whitneyarthofer.com
xn--9vvu50a.com
those2smartgirls.com
escolamasrour.com
studio1926.com
minisdiner.info
boxescar.com
4rt.club
ilovescience.news
theberknszja.com
bitlattice.limited
haroldcomere.com
manx497.com
honda-power-products.com
sirlocks.com
lumio-rh.net
lp-world.com
linkpedia.info
htphome.com
robotforall.com
32gd0.win
rmsnow.com
wdfdf.cymru
sbdfengji.com
turbotomperformance.com
advancedcharterindustries.com
atconstrucciones.com
nacemo.com
Targets
-
-
Target
RFQ_TMZ14062020.exe
-
Size
242KB
-
MD5
051b8c8e6d62b265a1486098755c8f92
-
SHA1
0c4d1555f68e60702fdecd2a5efe9f92b6fc9852
-
SHA256
e667a864a89ee23cf61430baa3eafd40ce829dbb6b4ae31ef7a65f645cf13d2c
-
SHA512
40a7e97d3cf117e92a5e676927f46eaf9f22f4a96ad4d66d8fba56fab563d1ef6e4761fecf038ea62c13d760e86bba787b9a80aa870312d202a2ed12a4a29356
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Formbook Payload
-
Deletes itself
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-