General
-
Target
9f61af191c20dc0eb90a92558e74059f
-
Size
1.1MB
-
Sample
240216-ehmb2ahc98
-
MD5
9f61af191c20dc0eb90a92558e74059f
-
SHA1
d16ddfebb7f36d76e6bac7f0010326ad51881f66
-
SHA256
b21eb6d14eae70e233132e7fa4e99fb282209f1c6ea8ba4d984e9585ee965e87
-
SHA512
9927573c6ab78921c467a54c8c9d5d1505a58986f9b63e55e7549237468072010dfdc6306dad3d96f94cda36a56b3e70847089cd9137ea805aa62723e9df8480
-
SSDEEP
12288:gJbARFY82gtPM6bSvJPpv1anYsVNGa1buEAr6g/xDvcu11wAyY+O64UzmsRNFDX2:gJkyi34xLN4AyzOQKflisEnZi
Malware Config
Extracted
formbook
4.1
dd2v
jkrqzmeyd.icu
cbluedottvwdshop.com
yhchen.space
premierhealthnwellness.com
szkuyaju.com
harvestmoonloans.net
dadematerial.com
mariaclarahairstudio.com
hwunvy.online
puloutjbmere.com
kossu1989.com
dubbedos.com
ncylis.com
hybrid-sol.com
travelature.com
gracefulcounts.com
66secretgarden.com
eslonyourcell.com
wisersponsorship.com
sepn3.com
Targets
-
-
Target
9f61af191c20dc0eb90a92558e74059f
-
Size
1.1MB
-
MD5
9f61af191c20dc0eb90a92558e74059f
-
SHA1
d16ddfebb7f36d76e6bac7f0010326ad51881f66
-
SHA256
b21eb6d14eae70e233132e7fa4e99fb282209f1c6ea8ba4d984e9585ee965e87
-
SHA512
9927573c6ab78921c467a54c8c9d5d1505a58986f9b63e55e7549237468072010dfdc6306dad3d96f94cda36a56b3e70847089cd9137ea805aa62723e9df8480
-
SSDEEP
12288:gJbARFY82gtPM6bSvJPpv1anYsVNGa1buEAr6g/xDvcu11wAyY+O64UzmsRNFDX2:gJkyi34xLN4AyzOQKflisEnZi
Score10/10-
Detect ZGRat V1
-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
ZGRat
ZGRat is remote access trojan written in C#.
-
Formbook payload
-
Suspicious use of SetThreadContext
-