General
-
Target
b5d3713200d78ffa108a19cecc8e5f9e27ca778a72eabc4e038821a1e9d56caa
-
Size
955KB
-
Sample
221130-r19aqshg42
-
MD5
91a972c03758ab433f7e7bbde4158e4d
-
SHA1
b31e8bec1883e2f6d69f0ee8cbfed15454e87c8c
-
SHA256
b5d3713200d78ffa108a19cecc8e5f9e27ca778a72eabc4e038821a1e9d56caa
-
SHA512
ccbbfe77338b609f09e5a76f5881e003d4711f8c0e15a9f21fa1b978518bb7a54453be9fa849f3d7d3318bb980c04e8375120965add9fb734b2cc458c438ffca
-
SSDEEP
12288:1umGKSUdXLIXyKQEy3NbeEOIoWhtfvKtEKu0I:omGKndbIrQEy3NbetsVvnKZI
Malware Config
Extracted
formbook
4.1
gbr
serabet.com
galanggroup.com
zweitmeinung-urologie.com
damsalon.com
binliwine.com
lifeladderindia.com
flyingwranchmanagement.com
tripsandturns.com
3headdesign.com
aluminumfacade.com
toprestau.com
facetreatspa.com
periodrescuekit.com
dbaojian.com
altinotokurtarma.com
gkpelle.com
loguslife.com
treatse.com
lghglzcnkx.net
jawharabh.com
Targets
-
-
Target
b5d3713200d78ffa108a19cecc8e5f9e27ca778a72eabc4e038821a1e9d56caa
-
Size
955KB
-
MD5
91a972c03758ab433f7e7bbde4158e4d
-
SHA1
b31e8bec1883e2f6d69f0ee8cbfed15454e87c8c
-
SHA256
b5d3713200d78ffa108a19cecc8e5f9e27ca778a72eabc4e038821a1e9d56caa
-
SHA512
ccbbfe77338b609f09e5a76f5881e003d4711f8c0e15a9f21fa1b978518bb7a54453be9fa849f3d7d3318bb980c04e8375120965add9fb734b2cc458c438ffca
-
SSDEEP
12288:1umGKSUdXLIXyKQEy3NbeEOIoWhtfvKtEKu0I:omGKndbIrQEy3NbetsVvnKZI
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Formbook payload
-
Suspicious use of SetThreadContext
-