General
-
Target
Ziraat bankası swift mesaji.exe
-
Size
522KB
-
Sample
220704-qagblabdg4
-
MD5
c701756136a34c15f281ce2fe6fd5904
-
SHA1
3002137e113c3b4b26f9aae7cd09b72a21146cb8
-
SHA256
c400e648af78ed3677bdca0096b54ea9e39c7418af48f4cac2936f424eb0ddc5
-
SHA512
4bccea01bf84da7829b64f02222149ea3b9093c23b8e699e20a17db6694e2e22b5a2820a1ebb356452844aa71c2f421c707e14e171662681e83b04204a7c81d4
Malware Config
Extracted
formbook
4.1
mh76
healthgovcalottery.net
wenxinliao.com
rooterphd.com
bbobbo.one
american-mes-de-dezembro.xyz
mintager.com
thespecialtstore.com
wemakegreenhomes.com
occurandmental.xyz
fidelityrealtytitle.com
numerisat.asia
wearestallions.com
supxl.com
rajacumi.com
renaziv.online
blixtindustries.com
fjljq.com
exploretrivenicamping.com
authenticusspa.com
uucloud.press
Targets
-
-
Target
Ziraat bankası swift mesaji.exe
-
Size
522KB
-
MD5
c701756136a34c15f281ce2fe6fd5904
-
SHA1
3002137e113c3b4b26f9aae7cd09b72a21146cb8
-
SHA256
c400e648af78ed3677bdca0096b54ea9e39c7418af48f4cac2936f424eb0ddc5
-
SHA512
4bccea01bf84da7829b64f02222149ea3b9093c23b8e699e20a17db6694e2e22b5a2820a1ebb356452844aa71c2f421c707e14e171662681e83b04204a7c81d4
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Formbook Payload
-
Suspicious use of SetThreadContext
-