General
-
Target
8353962967.zip
-
Size
209KB
-
Sample
221107-selg8afagp
-
MD5
e00de485e99019de7bb0ec9b13f06118
-
SHA1
1a5cf3bf820790ea136950465d553409ae3743c6
-
SHA256
e72fe7e257f4980cd501a7403aa116820d2ac1e176a28d61a9374df59f98d16d
-
SHA512
2581cad08cb84cc6ff3c25719baf0c581b44ac8631c563cb7e18588057234300568adb6dacee5cc75af8f0a26aff59c713c6401c6f993d8ff184b9ab1ac9b700
-
SSDEEP
6144:i7NylYU6BSfSLrsUvFhxOdyE5GbvQYVr//KXZO:SNIY/BSS39POLCvFuc
Malware Config
Extracted
formbook
4.1
je14
innervisionbuildings.com
theenergysocialite.com
565548.com
panghr.com
onlyonesolutions.com
stjohnzone6.com
cnotes.rest
helfeb.online
xixi-s-inc.club
easilyentered.com
theshopx.store
mrclean-ac.com
miamibeachwateradventures.com
jpearce.co.uk
seseragi-bunkou.com
minimaddie.com
commbank-help-849c3.com
segohandelsonderneming.com
namthanhreal.com
fototerapi.online
Targets
-
-
Target
jetssofftr543.exe
-
Size
221KB
-
MD5
c7c81ed3f21ca0f92316446946656c39
-
SHA1
d1a3c9c4a1ac579184967f604193f8c1f1c41693
-
SHA256
aad5593f8b48c2e45fb2344146ac1a16e79addf9fe859cf74c005b8c0b5bc452
-
SHA512
38b49646496bdaed201b855b0fe6fa5783102a780ff8a55bfa97a37cf53ccc9ab6cd36a234ae6bab1e488c741bc42879fe96a32aff3ed7906653d9e78ae25121
-
SSDEEP
6144:MEa0NUspTCne0ehbO4+MfVzDPdTG3xVzu5W+3uf:XUsp2epf+mT6VzaK
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Formbook payload
-
Executes dropped EXE
-
Loads dropped DLL
-
Suspicious use of SetThreadContext
-