General
-
Target
9107009779.zip
-
Size
201KB
-
Sample
230210-yhcmdahh78
-
MD5
dfd14b55b7b3bfb92a1e15993ddbfb1d
-
SHA1
b0d46a9e15511afd1450fb93ad41d23e7df58fdf
-
SHA256
2938c47e5d731e261a7f7f71c3e989e431ed688e6c716378440abf8ad1a8cf4b
-
SHA512
4a35358be4046b933f4802b677e36fa22ead2abd66343cd9118560b2bc0d0408305f953b9a22fe3ce4784f1fe314fbce38375bc09d6c39833ff8c0bd49463307
-
SSDEEP
3072:RWURLkx+P813UFH/qow6L1UY+hWjqolzUvwP/GQhWaEAJBF6pwBDd8eJHej0RB7P:YUB5g6L1/+3y/xW8rdvpoEwG
Malware Config
Extracted
formbook
4.1
je14
innervisionbuildings.com
theenergysocialite.com
565548.com
panghr.com
onlyonesolutions.com
stjohnzone6.com
cnotes.rest
helfeb.online
xixi-s-inc.club
easilyentered.com
theshopx.store
mrclean-ac.com
miamibeachwateradventures.com
jpearce.co.uk
seseragi-bunkou.com
minimaddie.com
commbank-help-849c3.com
segohandelsonderneming.com
namthanhreal.com
fototerapi.online
Targets
-
-
Target
32398cba360318425a3f1ba57676cba07546d5419e4d5f041752273ea389da33
-
Size
213KB
-
MD5
ace23ae0a5524989a50081e0416cd06f
-
SHA1
d5ee9183be486bf153d7666ca4301e600ea06087
-
SHA256
32398cba360318425a3f1ba57676cba07546d5419e4d5f041752273ea389da33
-
SHA512
9ae64c7e067d123357887951cbb4e5dfa1876a4a8febb41f6e9065e9c0cf0aaf68f4c0a449fe89ec46d51a807c545609b005bdbe4efdc34128a1c1de2287ed4f
-
SSDEEP
6144:QBn17YpPP72F3ApRMkW5lYeXzYMXAkqs1ZOcABcqGKq:g7YpH1RepXACZGAN
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Formbook payload
-
Executes dropped EXE
-
Loads dropped DLL
-
Suspicious use of SetThreadContext
-