General
-
Target
SecuriteInfo.com.BackDoor.SpyBotNET.25.12085.30753.exe
-
Size
221KB
-
Sample
220831-pewreaeack
-
MD5
b97f2d95c4b21597d3f16064028b3536
-
SHA1
037ceb6971a7501dc92dd709de15543a4bb0f8ae
-
SHA256
69a0c9f8165bcb6db8b2f8b3dc4f7cb8535c92db368a95deba521ce9d0cc1008
-
SHA512
e98b96b027cd89a1e025ae2875fe72197bd0a659583e787bd62c6a0957650b3c52254e8855782078d4c4fc87e9726995fc15e026f6710fa1ba50b88288160790
-
SSDEEP
3072:qie6Njrjc/Ddpmj9WH6/PgXRBJjWs7EMJfldMW/3eQ3P17jJ4pWV:qQDuA9Wa/PuRBJj6gP74p
Malware Config
Extracted
formbook
4.1
mh76
healthgovcalottery.net
wenxinliao.com
rooterphd.com
bbobbo.one
american-mes-de-dezembro.xyz
mintager.com
thespecialtstore.com
wemakegreenhomes.com
occurandmental.xyz
fidelityrealtytitle.com
numerisat.asia
wearestallions.com
supxl.com
rajacumi.com
renaziv.online
blixtindustries.com
fjljq.com
exploretrivenicamping.com
authenticusspa.com
uucloud.press
Targets
-
-
Target
SecuriteInfo.com.BackDoor.SpyBotNET.25.12085.30753.exe
-
Size
221KB
-
MD5
b97f2d95c4b21597d3f16064028b3536
-
SHA1
037ceb6971a7501dc92dd709de15543a4bb0f8ae
-
SHA256
69a0c9f8165bcb6db8b2f8b3dc4f7cb8535c92db368a95deba521ce9d0cc1008
-
SHA512
e98b96b027cd89a1e025ae2875fe72197bd0a659583e787bd62c6a0957650b3c52254e8855782078d4c4fc87e9726995fc15e026f6710fa1ba50b88288160790
-
SSDEEP
3072:qie6Njrjc/Ddpmj9WH6/PgXRBJjWs7EMJfldMW/3eQ3P17jJ4pWV:qQDuA9Wa/PuRBJj6gP74p
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Formbook payload
-
Downloads MZ/PE file
-
Suspicious use of SetThreadContext
-