General
-
Target
tmp
-
Size
642KB
-
Sample
220705-xemgqsdgc5
-
MD5
d3d5c533407fa52d0a2ab0e74c844df4
-
SHA1
c6d00c29f3797a7835ccb178a02d691d515c2b08
-
SHA256
c15b6c5b17eaedb2a9bfec349a7c7a394a3ff40440728a4fe52109530f6e89ce
-
SHA512
4d60e670924280e99257296d00e0fdc44d395dc14fd839671a22fc02045fda9e1d57c2bc2160d66b95d21270e0147adcb80d6f455790bb0f27544ae9f19c4071
Malware Config
Extracted
formbook
4.1
sd28
589723.icu
syzyzc.com
ydnss.info
colorharper.com
yueyuehecha.top
citymedia.digital
seradanvers.com
onufo.com
lordflyer.com
pittsburgh.run
55vipapp021.com
reducedenergyprices.info
note-ice.com
bingoka.com
crane.show
collectorshost.com
shahidil.com
kenichitanaka.com
miyuki-net.xyz
brillianttnc.com
Targets
-
-
Target
tmp
-
Size
642KB
-
MD5
d3d5c533407fa52d0a2ab0e74c844df4
-
SHA1
c6d00c29f3797a7835ccb178a02d691d515c2b08
-
SHA256
c15b6c5b17eaedb2a9bfec349a7c7a394a3ff40440728a4fe52109530f6e89ce
-
SHA512
4d60e670924280e99257296d00e0fdc44d395dc14fd839671a22fc02045fda9e1d57c2bc2160d66b95d21270e0147adcb80d6f455790bb0f27544ae9f19c4071
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Formbook Payload
-
Deletes itself
-
Suspicious use of SetThreadContext
-