General
-
Target
PO AU74356 – For Mid June.rar
-
Size
605KB
-
Sample
220531-s5ykgafcfm
-
MD5
a67ad0da396537ef2c9b9b3b915ab4e6
-
SHA1
ca6d7dcdec4fd21809b312d3aea408ffa4d95470
-
SHA256
5af12eff648e8c7aed0ad5933ba0c874c1ec33e35fcce1591cb26b5b680ccd73
-
SHA512
bc61e3ef1f3a2880f48b20421f5ae8611a9c923e104573eab5a011433582a6cdb9b1179c597f398982f8f830d173496e634cde638c7db601287e29423faef6b5
Malware Config
Extracted
formbook
4.1
t19g
playstationspiele.com
cakesbyannal.com
racepin.space
anti-offender.com
magnetque.com
farragorealtybrokerage.com
khuludmohammed.com
v33696.com
84ggg.com
d440.com
soccersmarthome.com
ofthis.world
fivestaryardcards.com
lusyard.com
gghft.com
viajesfortur.com
rationalirrationality.com
hanaramenrestaurant.com
exactlycleanse.com
martensenargentina.com
Targets
-
-
Target
PO AU74356 – For Mid June.exe
-
Size
675KB
-
MD5
e524708edfa0588f48c1f82421262794
-
SHA1
a4af13dba0ce7be02f3d3408a34071df9c927d5d
-
SHA256
fa100b947c2ad8d93cc6f323547650927145917919bf06e33532fb28903d09a6
-
SHA512
e27f2bff8afd7d2962c06bacb011417616db9762fcf810abfd928585d793f347506f825e825e516af59ce433f5521b8c49caa6486cf1f20360d2aba65ac7abd1
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Formbook Payload
-
Executes dropped EXE
-
Suspicious use of SetThreadContext
-