General
-
Target
tmp
-
Size
770KB
-
Sample
220706-q7eh9sfeb6
-
MD5
952e007eaae74fbdc16ba43932395b4b
-
SHA1
54fcb053d09600ffda2d4e95d050e7991a75acb0
-
SHA256
cad3c55468a545fa192d342b696c573a3d19c36673fd7524e982069fe3bb6109
-
SHA512
2dd973e9662f4eab0b7631df189b90cadf5ecf5ab2ee9a8f26d49e83040cf4666726a44047e355f404c3f9f776481eeec075734d52d00c5e39cc97b1ef135fb1
Malware Config
Extracted
formbook
4.1
s0s2
stripe-forecast.com
perfectingnextstage.com
primarole.com
nonnydesigns.com
wordsofweightandlevity.com
mafleursam.com
hardwarepicker.tech
minex-intl.com
thenextbigtech.net
rabeproject.com
sticktogracestudio.com
releve.space
readoku.net
carings.net
nasdaq-ex.store
au-techng.com
thethoughtgenius.com
how-to-learn-languages.net
kitabisabelanja.com
awndka.xyz
Targets
-
-
Target
tmp
-
Size
770KB
-
MD5
952e007eaae74fbdc16ba43932395b4b
-
SHA1
54fcb053d09600ffda2d4e95d050e7991a75acb0
-
SHA256
cad3c55468a545fa192d342b696c573a3d19c36673fd7524e982069fe3bb6109
-
SHA512
2dd973e9662f4eab0b7631df189b90cadf5ecf5ab2ee9a8f26d49e83040cf4666726a44047e355f404c3f9f776481eeec075734d52d00c5e39cc97b1ef135fb1
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Formbook Payload
-
Blocklisted process makes network request
-
Deletes itself
-
Suspicious use of SetThreadContext
-