General
-
Target
SecuriteInfo.com.Win32.PWSX-gen.15269.16914.exe
-
Size
732KB
-
Sample
221206-lkyamsed26
-
MD5
1489d7e40e1691026ff98c8bf1a83eee
-
SHA1
e08a1b6b74fe0d35bc2f19ed90ae90839958a45c
-
SHA256
53176c142b4a57f89c57ed969d3a578640841c09db2a58bc9f360a636c8d5947
-
SHA512
4ea9470172510717f0d84fc469bb3cb9eb3146da7e868030543c2d7a2ce532f264525ec0d3ff185bbce1bf4476719a4c175130734c672ab9c3a2acc4651ab8d0
-
SSDEEP
12288:awlTqmomPZefvYh9J5rArqIyJdY4fJmIQEBg3BCJCfIUc5Yytl1sPtqvyun/Y:9omxiv6b5rA7wdYicEnCwUcSytwQF/Y
Malware Config
Extracted
formbook
4.1
ndgi
vuicotvxrejp3il.xyz
w3fa6.net
sappuno02.com
konstruksirumah.xyz
usalifehealth.com
and1f.xyz
atenmentfstinfdow.beauty
primepipe.net
roundhouseny.com
alexandermcqueen.icu
transporteavalos.com
spankmetaverse.xyz
jhccowholesale.com
bielefeldgebaeudereinigung.com
saintraphaelschool.com
larifaa.online
dejabrew.info
izabelaeraphael.com
granniestoneet.com
greensourceseed.com
Targets
-
-
Target
SecuriteInfo.com.Win32.PWSX-gen.15269.16914.exe
-
Size
732KB
-
MD5
1489d7e40e1691026ff98c8bf1a83eee
-
SHA1
e08a1b6b74fe0d35bc2f19ed90ae90839958a45c
-
SHA256
53176c142b4a57f89c57ed969d3a578640841c09db2a58bc9f360a636c8d5947
-
SHA512
4ea9470172510717f0d84fc469bb3cb9eb3146da7e868030543c2d7a2ce532f264525ec0d3ff185bbce1bf4476719a4c175130734c672ab9c3a2acc4651ab8d0
-
SSDEEP
12288:awlTqmomPZefvYh9J5rArqIyJdY4fJmIQEBg3BCJCfIUc5Yytl1sPtqvyun/Y:9omxiv6b5rA7wdYicEnCwUcSytwQF/Y
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Formbook payload
-
Suspicious use of SetThreadContext
-