General
-
Target
24_5df985493ee4e1c58b4c0698ec38322284d805227b0110d4dae2d6139fba4412.zip
-
Size
130KB
-
MD5
27d00104d240c6a01dc012502d5cb7c6
-
SHA1
fe4d71f4c0b6d6b2549538ea9432351b4ad972f3
-
SHA256
ac9cd34ce738d41b188e8c09023e18383a5a023ef9ddd900fed43fbc49e5c906
-
SHA512
95b71417ed0d270bd0e538553821d01836fe7ffa34a024c4b70a2f40bed289aeb4d0453f4ea6e935a38cd8a4e4b711da6371e1bc5ba35104f1637ebf1634c553
-
SSDEEP
3072:lP9Jr1T8+egwBLNYKxqG09//nX/Nfyr9CT5qVqA6:t9JBo+egYLJpkf/sET5GqP
Malware Config
Extracted
formbook
4.1
mg24
jhae3jp.store
generalfirstaidcourse.com
breville-accounting.com
homeinthehamptonsny.com
amphibiamerch.store
lagosstateteacherawards.africa
955.global
longmaosh.com
crblwks.com
horliga.co.uk
classicdancehitzofficial.com
crytodefi.online
huachunjianshe-sh.com
hotel-la-cascada.xyz
avastate.com
cheapweedseeds.com
abgroupthailand.com
context-switching.com
drsolarshine.site
nxeliz.xyz
Signatures
-
Formbook family
-
Formbook payload 1 IoCs
Files
-
24_5df985493ee4e1c58b4c0698ec38322284d805227b0110d4dae2d6139fba4412.zip
Password: infected
-
5df985493ee4e1c58b4c0698ec38322284d805227b0110d4dae2d6139fba4412
Password: infected
Headers
Sections