General
-
Target
SecuriteInfo.com.Win32.RATX-gen.2018.30304.exe
-
Size
946KB
-
Sample
221208-ll2z8ace5x
-
MD5
591e345ed1a7fa929b80cce8790e460f
-
SHA1
9992eadbc531dce1185f22b360410cbd11bd1989
-
SHA256
663d25f6a1e39bebdacdb5164e441faaa4466a00ed636b360c1d981a5f92c5d8
-
SHA512
f765de77da52cb578a3a2a7ab0f3d8a34baa96db982f972dbe3bead73e418992ea5bf018b3619556ef83a9d05342b7c176579982fd017b9eeee3c75269dd7863
-
SSDEEP
24576:sqndl9aebRk+T7CYWL1wCE7HuzsthZmBHG:Ld3pbq+nnWL1w3TTthSH
Malware Config
Extracted
formbook
4.1
ndgi
vuicotvxrejp3il.xyz
w3fa6.net
sappuno02.com
konstruksirumah.xyz
usalifehealth.com
and1f.xyz
atenmentfstinfdow.beauty
primepipe.net
roundhouseny.com
alexandermcqueen.icu
transporteavalos.com
spankmetaverse.xyz
jhccowholesale.com
bielefeldgebaeudereinigung.com
saintraphaelschool.com
larifaa.online
dejabrew.info
izabelaeraphael.com
granniestoneet.com
greensourceseed.com
Targets
-
-
Target
SecuriteInfo.com.Win32.RATX-gen.2018.30304.exe
-
Size
946KB
-
MD5
591e345ed1a7fa929b80cce8790e460f
-
SHA1
9992eadbc531dce1185f22b360410cbd11bd1989
-
SHA256
663d25f6a1e39bebdacdb5164e441faaa4466a00ed636b360c1d981a5f92c5d8
-
SHA512
f765de77da52cb578a3a2a7ab0f3d8a34baa96db982f972dbe3bead73e418992ea5bf018b3619556ef83a9d05342b7c176579982fd017b9eeee3c75269dd7863
-
SSDEEP
24576:sqndl9aebRk+T7CYWL1wCE7HuzsthZmBHG:Ld3pbq+nnWL1w3TTthSH
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Formbook payload
-
Suspicious use of SetThreadContext
-