General
-
Target
209f150e401442b5334c1d2c3084b8bf.exe
-
Size
820KB
-
Sample
221205-janbksgg39
-
MD5
209f150e401442b5334c1d2c3084b8bf
-
SHA1
d5d15147a737b90805e6c07d34fb597c93c1ec27
-
SHA256
56462c46e025fb1ddfe7793825dbde4130e9db4052b271f21b60069efeba96f6
-
SHA512
c0d4590c6afb1f9abd926c907adc4daea606bcfad2615e8ae5f426e18cef0414254cfa257f44a3e7cd59f8681db7bdc0a6a4cc33af51e16814e7db9a1909d272
-
SSDEEP
12288:QF+ciXyUwguIYoGVhj77o6lktulvWEBVr61jzfkg586aWHff:W+ZiUwCWpA6lYuVfjCXfB5O8f
Malware Config
Extracted
formbook
4.1
do25
nickifarina.site
nfptrwge.bar
nobreemporio.com
split-acres.com
sharingservice-act.com
nakedinktees.shop
zhensheng1988.com
ipiton.com
liftoffdigitalmarketing.com
karen.cool
theprotestantchurch.com
shirhadarr.com
azdtwp.com
comzestdent.com
jnsjh.com
in-heat-cool.com
dfefej.top
tumingchun.com
eisei-shouji.tokyo
sparecreeping.com
Targets
-
-
Target
209f150e401442b5334c1d2c3084b8bf.exe
-
Size
820KB
-
MD5
209f150e401442b5334c1d2c3084b8bf
-
SHA1
d5d15147a737b90805e6c07d34fb597c93c1ec27
-
SHA256
56462c46e025fb1ddfe7793825dbde4130e9db4052b271f21b60069efeba96f6
-
SHA512
c0d4590c6afb1f9abd926c907adc4daea606bcfad2615e8ae5f426e18cef0414254cfa257f44a3e7cd59f8681db7bdc0a6a4cc33af51e16814e7db9a1909d272
-
SSDEEP
12288:QF+ciXyUwguIYoGVhj77o6lktulvWEBVr61jzfkg586aWHff:W+ZiUwCWpA6lYuVfjCXfB5O8f
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Formbook payload
-
Suspicious use of SetThreadContext
-