General
-
Target
swift copy of payment MT301.exe
-
Size
722KB
-
Sample
230202-lcgb6ahf2w
-
MD5
6c8861d0c5093645595b3ff9187b6ebe
-
SHA1
1ee8d66607c82691ef0efc5a1a7d860fc02a23c2
-
SHA256
802ef9033535b7c8c8b6844eb030ab8fa10f6427d45d5b7f8339f5d89cff1958
-
SHA512
949694fd0c528b918e85e2a525a23b64006d4387758eae2e3fab1661bcd15883fce5dea06a05cc74902dd093a6a97f7973b87cac53001707cb8a04b955d79d63
-
SSDEEP
12288:fxKkMtEwcU3gZ+GQzjkATGdsWMQi4DvvH01VNelXWMUJIiwuYSlSrGo/1Sur:ph6AAgZbQzlGvi4DvvUD+XW6MSVAg
Malware Config
Extracted
formbook
4.1
gg62
growfast.africa
lerema.com
38945.se
wheelfermotors.africa
giftshareforyou.online
burrismktg.com
keepgrowing.uk
efefhomeless.buzz
bryanokoh.com
fashion-clothing-40094.com
andreasunshine.com
naijahood.africa
aditrirealty.com
kinnoitodatsumou.com
cryptoqzclimax.com
hairly.biz
comeuphither4.com
integrity360.ltd
flushywhole.com
8869365.com
Targets
-
-
Target
swift copy of payment MT301.exe
-
Size
722KB
-
MD5
6c8861d0c5093645595b3ff9187b6ebe
-
SHA1
1ee8d66607c82691ef0efc5a1a7d860fc02a23c2
-
SHA256
802ef9033535b7c8c8b6844eb030ab8fa10f6427d45d5b7f8339f5d89cff1958
-
SHA512
949694fd0c528b918e85e2a525a23b64006d4387758eae2e3fab1661bcd15883fce5dea06a05cc74902dd093a6a97f7973b87cac53001707cb8a04b955d79d63
-
SSDEEP
12288:fxKkMtEwcU3gZ+GQzjkATGdsWMQi4DvvH01VNelXWMUJIiwuYSlSrGo/1Sur:ph6AAgZbQzlGvi4DvvUD+XW6MSVAg
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Formbook payload
-
Deletes itself
-
Suspicious use of SetThreadContext
-