General
-
Target
SecuriteInfo.com.BackDoor.RatNET.2.23132.14296.exe
-
Size
853KB
-
Sample
220919-1tb64aeeej
-
MD5
9c1e0b06fbf4b97322e1ed0a2b96b0ea
-
SHA1
f373a8bb2a3a250cbeba7543d6171c2a16484f16
-
SHA256
0c7b5e8115ca42bf2a539dc86e042acdd873463d4724fbb61c923a6d0aa0e869
-
SHA512
80837db6c5e86a4243c40b78a028a4b204e928365b6f8a8e93c5ac9652085f9b4984ef8646dde700872ca56926b6b4f339f34296dfa889ad6f55772692daf16d
-
SSDEEP
12288:6FnvHiPqmzdmWouEcFctkHvOjNojfezDlchYJ8hVdf5Ib2pA:O9m0WoYFqkmjNQfezDChYJ4df
Malware Config
Extracted
formbook
4.1
ng04
tevimaq.com
easterspecialtystore.com
smartlever.tech
10312.uk
tanjawiharbi.co.uk
471338.com
horusventure.com
empress-care.com
sinrian.com
465951.com
aemsti.com
nxcourier.com
stargatefarms.com
lalyquainvestment.com
dailysportsadvice.com
justlistmoore.com
stoneonroll.online
tatianakolomiets.com
barcodebbm.com
protectorship.world
Targets
-
-
Target
SecuriteInfo.com.BackDoor.RatNET.2.23132.14296.exe
-
Size
853KB
-
MD5
9c1e0b06fbf4b97322e1ed0a2b96b0ea
-
SHA1
f373a8bb2a3a250cbeba7543d6171c2a16484f16
-
SHA256
0c7b5e8115ca42bf2a539dc86e042acdd873463d4724fbb61c923a6d0aa0e869
-
SHA512
80837db6c5e86a4243c40b78a028a4b204e928365b6f8a8e93c5ac9652085f9b4984ef8646dde700872ca56926b6b4f339f34296dfa889ad6f55772692daf16d
-
SSDEEP
12288:6FnvHiPqmzdmWouEcFctkHvOjNojfezDlchYJ8hVdf5Ib2pA:O9m0WoYFqkmjNQfezDChYJ4df
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Formbook payload
-
Suspicious use of SetThreadContext
-