General
-
Target
tmp
-
Size
538KB
-
Sample
220706-yv2f9sagg9
-
MD5
c0138bfa58d20206600eaf1657f95f75
-
SHA1
fa232e4df93c81093044ff552381d41ebcc5f443
-
SHA256
79e6aa9fb18847e4c5b5e00dd742b3b00057d20bbede37f1c8740b21666b44e1
-
SHA512
082a20109057787fdb3d8bfa5607e379c4d803d862367078e24a40018c3a6ed4fa3c09ce0c95152a169cfa98f2348c47e20af1cbf4b69dd164fcc6b9a80040bd
Malware Config
Extracted
formbook
4.1
bk19
parkersuite.com
quanzhujs.com
ofourfuture.com
palazzonutraceuticals.com
xowshfv.top
casinoguide.bet
kangdurian.com
luxurymainewaterfront.com
sdjyyy.com
uglymugvs.com
lawncaregeni.com
simproful.net
upskirts-tube.com
taiylormade.com
okyxx1k4w.digital
shop-marvel.direct
tecdiario.com
click2claim.xyz
2dot2dot.space
gercektarih.online
Targets
-
-
Target
tmp
-
Size
538KB
-
MD5
c0138bfa58d20206600eaf1657f95f75
-
SHA1
fa232e4df93c81093044ff552381d41ebcc5f443
-
SHA256
79e6aa9fb18847e4c5b5e00dd742b3b00057d20bbede37f1c8740b21666b44e1
-
SHA512
082a20109057787fdb3d8bfa5607e379c4d803d862367078e24a40018c3a6ed4fa3c09ce0c95152a169cfa98f2348c47e20af1cbf4b69dd164fcc6b9a80040bd
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Formbook Payload
-
Deletes itself
-
Suspicious use of SetThreadContext
-