General
-
Target
0d9b2efac64b4245292e7c3112ec8771.bin
-
Size
686KB
-
Sample
230316-g9v5cshd53
-
MD5
9d4c5b42b919d1f1d5a2d48ddb14ad95
-
SHA1
ab6c2f801d3eb911b9d6b052e65d5704b9634651
-
SHA256
e2ab9f8e6ccfd04fb283217ddc26ef9805a7218060036303571cd092d17ed97e
-
SHA512
e3c8d1621aabfe9ef6bf7b88b53fb8b667b3d77c6609244d2876cef47463b2ee7dbd88b0472802ab3ecf91480a460f9cbd6fd463134837813bf3c6612c9081bc
-
SSDEEP
12288:FAakrtcH1CONlH9RZfPH5lt59k1SpZpqHCZZAbMUkjn3Prko6pMAYqndU1vIP+pF:+rtcVBNlH3R5llmSTpXZ/h3T76pNQvyO
Malware Config
Extracted
formbook
4.1
ar73
classgorilla.com
b6817.com
1wwuwa.top
dgslimited.africa
deepwaterships.com
hkshshoptw.shop
hurricanevalleyatvjamboree.com
ckpconsulting.com
laojiangmath.com
authenticityhacking.com
family-doctor-53205.com
investinstgeorgeut.com
lithoearthsolution.africa
quickhealcareltd.co.uk
delightkgrillw.top
freezeclosettoilet.com
coo1star.com
gemgamut.com
enrichednetworksolutions.com
betterbeeclean.com
Targets
-
-
Target
5dc52da7b97835654bab2a3a39e93d412a50608bfd7dfccb87ff716c9aba6a37.exe
-
Size
761KB
-
MD5
0d9b2efac64b4245292e7c3112ec8771
-
SHA1
61b32ec6303fd7fa890dadc3f3f18128f2c264c9
-
SHA256
5dc52da7b97835654bab2a3a39e93d412a50608bfd7dfccb87ff716c9aba6a37
-
SHA512
47d00d1a6e705662d18fb3a9885af5a8a51ad3ef4ad3bbbcabf544e5b9a959dc49be99fdea562ff6db59981941db91de761d7f3dbf59ccaaa12a9a35357081ed
-
SSDEEP
12288:QCZzLzeEILPryAzRVelrKhVaZF6NPeUDQ1cwCbGOaS80v2ekdeoFuPD7hXJGRTw:QCZzeEIrryORVep2QF6N/Q1bWGDTFmJT
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Formbook payload
-
Suspicious use of SetThreadContext
-