General
-
Target
ecc3d188c07059b0938f71d2897fb0e2.exe
-
Size
1.2MB
-
Sample
230608-m9c7faef64
-
MD5
ecc3d188c07059b0938f71d2897fb0e2
-
SHA1
818243a6acd3ea9db962dde68ddab8babe911c46
-
SHA256
949ea89d7f493bd6476da1ea5923da51a93d36c8051c7802c3eee2a71bd9f451
-
SHA512
46c7c1130d8997dfafbed6ba1fbb70cdc64797f191bb1f3caa503e525b9460b858b6f894111d871831166703493c14a5f3eb09209f147f3a521494d45a6eef67
-
SSDEEP
24576:xcUMsJkI/T/O7N/Rzor3Iu0aMp/7YcTgXkV5GE9o:xcEaWOhZor3Iux+zVTJ5k
Malware Config
Extracted
formbook
4.1
t3c9
shadeshmarriagemedia.com
e-russ.com
sofiashome.com
theworriedwell.com
americantechfront.com
seasonssparkling.com
maximuscanada.net
tifin-private-markets.com
amecc2.net
xuexi22.icu
injectiontek.com
enrrocastoneimports.com
marvelouslightcandleco.com
eaamedia.com
pmediaerp.com
tikivips111.com
chesterfieldcleaningcare.com
thecrowdedtablemusic.com
duncanvillepanthers.com
floriculturajoinville.xyz
Targets
-
-
Target
ecc3d188c07059b0938f71d2897fb0e2.exe
-
Size
1.2MB
-
MD5
ecc3d188c07059b0938f71d2897fb0e2
-
SHA1
818243a6acd3ea9db962dde68ddab8babe911c46
-
SHA256
949ea89d7f493bd6476da1ea5923da51a93d36c8051c7802c3eee2a71bd9f451
-
SHA512
46c7c1130d8997dfafbed6ba1fbb70cdc64797f191bb1f3caa503e525b9460b858b6f894111d871831166703493c14a5f3eb09209f147f3a521494d45a6eef67
-
SSDEEP
24576:xcUMsJkI/T/O7N/Rzor3Iu0aMp/7YcTgXkV5GE9o:xcEaWOhZor3Iux+zVTJ5k
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Formbook payload
-
ModiLoader Second Stage
-
Drops startup file
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of SetThreadContext
-