General
-
Target
tmp
-
Size
185KB
-
Sample
220830-heqf3adbem
-
MD5
41421332144b8f31a3717e7d4fb39ffe
-
SHA1
43e4bfb559364565e18fd0725108fadd5a4c8ab5
-
SHA256
54f7d9a22ef4e4ae2bd08066fed9be3d1296bf91cdd238f58a3857ae002fe209
-
SHA512
feef385366d64b4b7fae720ae3281fb1b746f1f16eed0bfad624e892a8a32bb9d2ac7e0318bd7b8700a3dcce2b8a3d4db3fde1e826954496d95ab0f42e109349
-
SSDEEP
3072:Pw4tkWkW4VDb05B3E1Lqg0laIA7Gbqgb8iQIy70mRSMbrfzbMDMUXyDb469:AmHvEJT0l/A7GbqgQiQAmRSMbDMDMUil
Malware Config
Extracted
formbook
4.1
mh76
healthgovcalottery.net
wenxinliao.com
rooterphd.com
bbobbo.one
american-mes-de-dezembro.xyz
mintager.com
thespecialtstore.com
wemakegreenhomes.com
occurandmental.xyz
fidelityrealtytitle.com
numerisat.asia
wearestallions.com
supxl.com
rajacumi.com
renaziv.online
blixtindustries.com
fjljq.com
exploretrivenicamping.com
authenticusspa.com
uucloud.press
Targets
-
-
Target
tmp
-
Size
185KB
-
MD5
41421332144b8f31a3717e7d4fb39ffe
-
SHA1
43e4bfb559364565e18fd0725108fadd5a4c8ab5
-
SHA256
54f7d9a22ef4e4ae2bd08066fed9be3d1296bf91cdd238f58a3857ae002fe209
-
SHA512
feef385366d64b4b7fae720ae3281fb1b746f1f16eed0bfad624e892a8a32bb9d2ac7e0318bd7b8700a3dcce2b8a3d4db3fde1e826954496d95ab0f42e109349
-
SSDEEP
3072:Pw4tkWkW4VDb05B3E1Lqg0laIA7Gbqgb8iQIy70mRSMbrfzbMDMUXyDb469:AmHvEJT0l/A7GbqgQiQAmRSMbDMDMUil
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Formbook payload
-
Deletes itself
-
Suspicious use of SetThreadContext
-