General
-
Target
JJUmnnkIxSCyKik.exe
-
Size
778KB
-
Sample
240428-kxqkwscd3y
-
MD5
d3276b14eaab222d13f7f15dc879ed16
-
SHA1
8d5809ae7176e28e61245b18678ef3bada66f414
-
SHA256
864b5669f18681ae03edbd7c3b3bbf6732e55191d4883f18783eb9c611fa9a17
-
SHA512
9a552073cb2f81f6b623f20bc388a68a1c1e5fe79198ae5c59a9548e5228db408e263bc3f57ac8a915e7971df41be5a1f6588b225ac5fdf6500bb5f58086ac52
-
SSDEEP
24576:AHPjKr5BNDoxwj4R0zyfx+VC6vkI8F4WSI+y9:6k5BNYSNq6vcI8FQW
Malware Config
Extracted
formbook
4.1
be03
458q14v4ams2.com
priceoctopus.com
betinplay.xyz
bcnd.xyz
1510soliveavenue.com
mcdpropertypros.com
reddcrownexpress.com
rewardlabs.shop
burenbrand.com
revand.io
tractionendurancecoaching.com
jotaerreshopp.com
shopboyg.com
dakor.shop
groundswellmag.life
nehagadodia.com
dancarellibizbroker.com
meconline.co
ttmq.cc
thegoldenyouph.com
Targets
-
-
Target
JJUmnnkIxSCyKik.exe
-
Size
778KB
-
MD5
d3276b14eaab222d13f7f15dc879ed16
-
SHA1
8d5809ae7176e28e61245b18678ef3bada66f414
-
SHA256
864b5669f18681ae03edbd7c3b3bbf6732e55191d4883f18783eb9c611fa9a17
-
SHA512
9a552073cb2f81f6b623f20bc388a68a1c1e5fe79198ae5c59a9548e5228db408e263bc3f57ac8a915e7971df41be5a1f6588b225ac5fdf6500bb5f58086ac52
-
SSDEEP
24576:AHPjKr5BNDoxwj4R0zyfx+VC6vkI8F4WSI+y9:6k5BNYSNq6vcI8FQW
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Formbook payload
-
Suspicious use of SetThreadContext
-