General
-
Target
c47b64bc3082c59d54077af047c2bcffd0d1859934927dc58ffc14b7ac52a1c8
-
Size
412KB
-
Sample
220521-mycfrscfe8
-
MD5
0f9eb810be9b50a8b2d6c7c7988cb6c5
-
SHA1
18f4077403d5cb0530ba6c45488480bb534a4117
-
SHA256
c47b64bc3082c59d54077af047c2bcffd0d1859934927dc58ffc14b7ac52a1c8
-
SHA512
1343d43a877ffefc9fb22e96071172aabb656334073aa328f9ffbda2cd12220e0fc54d4d5e4acd52a4ee9a274b3ee926f5543852c83c93220ac0be9845248c48
Static task
static1
Behavioral task
behavioral1
Sample
Requirement list.exe
Resource
win7-20220414-en
Malware Config
Extracted
formbook
4.1
c38r
angleprotool.com
drilldownaccountancy.com
puur-bb.info
laptoprepairbrighton.net
mainstale.com
soketones.com
cohi.ltd
washntivow.com
datajagabon.online
solidlike.com
tapaznoncc.com
deadoralive.site
sharkapexdwal.com
tribun-news.com
67chain.com
paramorphous.net
chicagoxqa.com
301zaq.info
mansfieldpowdercoating.net
stopdizzy.com
edildecor.info
earth-edge.com
hklpf.com
umiusnage7.ltd
justinteutonico.com
daxiangshare.com
thiwari.com
merm.world
westernconsultant.com
com-musclebuilding.services
vitaminarts.com
gbgroup100.com
sanpulga.com
timelesssurvival.com
hgeetor.com
get-it-cheaper.com
shivmudraagency.com
widthcycl.com
jhomerballfunerealhome.com
frasesymasusa.com
appsmomo.com
tv16589.info
theultimatechatzone.com
obpromote-h789.info
douxiangshou.com
lnternetbank.com
theinvestortribe.com
dentv.fyi
orchestre-rockseller.com
gefyun.com
thankgivingdecorating2017.com
randenanetu.info
engineeringku.com
ups-usa.com
911tfc.com
chairikitchen.com
recovery-web.info
top-blog.review
gettechtags.com
equifsxsecurity2017.com
icbcbk.net
sgllawnservices.com
thewellness.store
rockingchairworld.info
regulars7.info
Targets
-
-
Target
Requirement list.exe
-
Size
648KB
-
MD5
5dff100422e961e681af596f5307ba6d
-
SHA1
68735aa701b4be6df63b0fed0edec4800027836b
-
SHA256
def5dbf8e48af782ccb741ff6a1e1357af8dcafb701089b7f2d1c0919ae79f05
-
SHA512
07aab159926347c24b6513c7f34a6fd52804f144ca1ff549aea14105a6bcaea715d8258a684be5fb852e9f33f87b96b991503b826bdef77b1dd2de29ac892c95
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
suricata: ET MALWARE FormBook CnC Checkin (POST) M2
suricata: ET MALWARE FormBook CnC Checkin (POST) M2
-
Formbook Payload
-
Adds policy Run key to start application
-
Deletes itself
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-