General
-
Target
58d26f9315cc3096983319b852549982_JaffaCakes118
-
Size
851KB
-
Sample
240519-gegy9ach8y
-
MD5
58d26f9315cc3096983319b852549982
-
SHA1
dc0adb78294e3f0035da1e2dd7283c6bea2e467b
-
SHA256
0d08fa955cee1cec998814bd6d02622e86768d03576f525ffb4e7ccaabf6173c
-
SHA512
b08c228b5ad68788985f078fd6481e81e47e9993e2746be5ec948af48492c6267581f8b8576c71820fab37e2b4989d8077d812f54f9f883ddcbd04ed75227dac
-
SSDEEP
12288:m38ZC2jTIBwgM9poZThtKyx12lwLxog3rChBQhwIRP1U0+Css226LcF:cfzBw3PotKWR9h3On6t1UusW6
Malware Config
Extracted
formbook
4.1
lso
poporoshop.com
qizuan555.com
yourcraigslist.net
healthcaredegreesonline.net
takeittomax.com
xyhftl.com
bastasuv.com
sevensinsrj.com
patticrumprealestate.com
thelibraryofspice.com
ramseyedk12.com
indyhvacpros.com
smallvendingmachines.com
jscrchina.com
intospace2.net
facialhq.com
dilauto-a.online
lebaise.com
maxfaxassociates.com
kwik.life
Targets
-
-
Target
58d26f9315cc3096983319b852549982_JaffaCakes118
-
Size
851KB
-
MD5
58d26f9315cc3096983319b852549982
-
SHA1
dc0adb78294e3f0035da1e2dd7283c6bea2e467b
-
SHA256
0d08fa955cee1cec998814bd6d02622e86768d03576f525ffb4e7ccaabf6173c
-
SHA512
b08c228b5ad68788985f078fd6481e81e47e9993e2746be5ec948af48492c6267581f8b8576c71820fab37e2b4989d8077d812f54f9f883ddcbd04ed75227dac
-
SSDEEP
12288:m38ZC2jTIBwgM9poZThtKyx12lwLxog3rChBQhwIRP1U0+Css226LcF:cfzBw3PotKWR9h3On6t1UusW6
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Formbook payload
-
Suspicious use of SetThreadContext
-