General
-
Target
SecuriteInfo.com.Trojan.PackedNET.1617.32609.30408.exe
-
Size
1.0MB
-
Sample
221124-e7n7xscf71
-
MD5
21eb8736dd89da5191e78fde4a3ca3da
-
SHA1
c96857cc2d0177ec028bba3e467f3930e5c02f85
-
SHA256
e8ed49650b42ebb3a251a7353809309e94f885316bf1b0153def1c180628cee4
-
SHA512
71ba19fd8cb5bbef1f4fb0d9a03ab7b9c8724263b0ab38e5c9cb979b65f42e7743c3e46050fc2b2fc52087a5e4523b8482c3a9acd3858a8bb71b536f4a220b6e
-
SSDEEP
12288:oyRPYYsZ1DX/VDJtV7oT6P9GJ2LjmgoxQT0z/ZBQfWh+QJFuUtxEr5Cd4uUVhjPO:oCYYk8WP9GcWje0zXhnzxEPZV
Malware Config
Extracted
formbook
4.1
ng04
tevimaq.com
easterspecialtystore.com
smartlever.tech
10312.uk
tanjawiharbi.co.uk
471338.com
horusventure.com
empress-care.com
sinrian.com
465951.com
aemsti.com
nxcourier.com
stargatefarms.com
lalyquainvestment.com
dailysportsadvice.com
justlistmoore.com
stoneonroll.online
tatianakolomiets.com
barcodebbm.com
protectorship.world
Targets
-
-
Target
SecuriteInfo.com.Trojan.PackedNET.1617.32609.30408.exe
-
Size
1.0MB
-
MD5
21eb8736dd89da5191e78fde4a3ca3da
-
SHA1
c96857cc2d0177ec028bba3e467f3930e5c02f85
-
SHA256
e8ed49650b42ebb3a251a7353809309e94f885316bf1b0153def1c180628cee4
-
SHA512
71ba19fd8cb5bbef1f4fb0d9a03ab7b9c8724263b0ab38e5c9cb979b65f42e7743c3e46050fc2b2fc52087a5e4523b8482c3a9acd3858a8bb71b536f4a220b6e
-
SSDEEP
12288:oyRPYYsZ1DX/VDJtV7oT6P9GJ2LjmgoxQT0z/ZBQfWh+QJFuUtxEr5Cd4uUVhjPO:oCYYk8WP9GcWje0zXhnzxEPZV
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Formbook payload
-
Suspicious use of SetThreadContext
-