General
-
Target
tmp
-
Size
770KB
-
Sample
220706-q1jveaddbn
-
MD5
4f4ffe55d08d242d9b54ec21f01549de
-
SHA1
4792ee54fadeeb6bc8a26982b1bfc8fa58cd1d66
-
SHA256
27d5408961dba9baf42c42b2574c863ccf523ee98fb0648559b733dd52fb37dc
-
SHA512
ffa14345a9791fac0a0fafd3ddb3fac8912f098615bdd1b7a287109eb2a223044c8180f4321218202b2ad06015d33936d610abe57336c7c9cfcd278d0e26b9fa
Malware Config
Extracted
formbook
4.1
s0s2
stripe-forecast.com
perfectingnextstage.com
primarole.com
nonnydesigns.com
wordsofweightandlevity.com
mafleursam.com
hardwarepicker.tech
minex-intl.com
thenextbigtech.net
rabeproject.com
sticktogracestudio.com
releve.space
readoku.net
carings.net
nasdaq-ex.store
au-techng.com
thethoughtgenius.com
how-to-learn-languages.net
kitabisabelanja.com
awndka.xyz
Targets
-
-
Target
tmp
-
Size
770KB
-
MD5
4f4ffe55d08d242d9b54ec21f01549de
-
SHA1
4792ee54fadeeb6bc8a26982b1bfc8fa58cd1d66
-
SHA256
27d5408961dba9baf42c42b2574c863ccf523ee98fb0648559b733dd52fb37dc
-
SHA512
ffa14345a9791fac0a0fafd3ddb3fac8912f098615bdd1b7a287109eb2a223044c8180f4321218202b2ad06015d33936d610abe57336c7c9cfcd278d0e26b9fa
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Formbook Payload
-
Blocklisted process makes network request
-
Deletes itself
-
Suspicious use of SetThreadContext
-