General
-
Target
a397ea09777854429437e8bda2f2b0ac22d6d5dec93418b3b33ce66b33d74576.zip
-
Size
543KB
-
Sample
240528-bt9d6aaf95
-
MD5
5c460e4874274e004cb1358b14948ae8
-
SHA1
632853b7adc7f558472fae59a3e6e79e9c4378cf
-
SHA256
a397ea09777854429437e8bda2f2b0ac22d6d5dec93418b3b33ce66b33d74576
-
SHA512
925ab713d36ae88c3f56549cf4a3038c36e6842ec6ce6215ea76cb9d9b2c816da3ec30503f9fbf207c6a8039722ad31b93e3d41541575c7d07e93eb61f82e25e
-
SSDEEP
12288:XLWLqa44/JMO83ksdDiVRkvJU0qEvzTIVoXNgvVqk0WF5ehB82iE3JKDmbr08b8:7h4/SyHqNnLTavVqknejTP5KmC
Malware Config
Extracted
formbook
4.1
gy14
mavbam.com
theanhedonia.com
budgetnurseries.com
buflitr.com
alqamarhotel.com
2660348.top
123bu6.shop
v72999.com
yzyz841.xyz
247fracing.com
naples.beauty
twinklethrive.com
loscaseros.com
creditspisatylegko.site
sgyy3ej2dgwesb5.com
ufocafe.net
techn9nehollywoodundead.com
truedatalab.com
alterdpxlmarketing.com
harborspringsfire.com
Targets
-
-
Target
Цитата.exe
-
Size
562KB
-
MD5
84144b6048277290bb6eb647bbc5ad2a
-
SHA1
609a26e95e4b343bfb47ab51bdd68ef9a8ef791f
-
SHA256
151bfa7336a9c96e65bf8a0eeb54a3d34665e612c8c5b3a7886f16a6f58277c4
-
SHA512
792f0c22ed8aef3766f773f4c49698e9d2d2678191c98493e83076fa90dc8a83d67cdd00fe46d7409b4eeb1539c542cd0219b4b9121d45ecbb0ec0ac3bd94baa
-
SSDEEP
12288:R+vLWa44/RYO83ksdpiVRkvZU08wvzTIVodNgvBqk0WFLehfK2iE3LKvmbrJ:E44/Ky7MN7LT4vBqkle1FPbKSd
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Detects executables packed with or use KoiVM
-
Formbook payload
-
Suspicious use of SetThreadContext
-