General
-
Target
FOB ORDER.COM.exe
-
Size
1.1MB
-
Sample
221019-nd92zafhen
-
MD5
26117b361e02465d64dec2279ce377d3
-
SHA1
3bb6970d86b1f92089aaf421a9e89d96bb64d219
-
SHA256
260af1fc04af75b421c4acfa45221bbf9a21ff9abedfe34e6c5d05b19b8ede5b
-
SHA512
35222dc760a28bdad4b0c887271b353c22cb991af40917130983f39144e96f87d3612a4b579e990c283dfc1778e53864486a8c43972cf538b0c4a67d25fd3f09
-
SSDEEP
24576:LxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxNuss2+syKrY9:B+DKrMl3p1SDRIesP918Fdj
Malware Config
Extracted
formbook
4.1
p94a
wishgrove.com
parqueveiculos.com
spiderwebs.online
chulkanadham.com
cdtuan.net
zxazm.com
payment6528832.xyz
fengtaiol.com
bffsmovie.com
aliceseagerfitness.com
garisluruskonsulindo.website
analytical-gutter.net
ahcq8.com
fenyoga.com
ecleptic.cat
conjurecrafts.com
aquaway.date
apenpokkenschoonmaakbedrijf.com
zgramr.top
boweknives.site
Targets
-
-
Target
FOB ORDER.COM.exe
-
Size
1.1MB
-
MD5
26117b361e02465d64dec2279ce377d3
-
SHA1
3bb6970d86b1f92089aaf421a9e89d96bb64d219
-
SHA256
260af1fc04af75b421c4acfa45221bbf9a21ff9abedfe34e6c5d05b19b8ede5b
-
SHA512
35222dc760a28bdad4b0c887271b353c22cb991af40917130983f39144e96f87d3612a4b579e990c283dfc1778e53864486a8c43972cf538b0c4a67d25fd3f09
-
SSDEEP
24576:LxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxNuss2+syKrY9:B+DKrMl3p1SDRIesP918Fdj
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Formbook payload
-
Deletes itself
-
Suspicious use of SetThreadContext
-