General
-
Target
Details of Your Etisalat Summary Bill for the Month of May-2024.zip
-
Size
620KB
-
Sample
240528-hy758aad61
-
MD5
7234662c06842b61dbed887447abbcdc
-
SHA1
1cffc92a5dd903c734073c2cc73bd9d774d56ef0
-
SHA256
4a766df7df844e26bf42bb4018b1aec0877baf3c20d6af7079aa0c2893977b2f
-
SHA512
cb4c3baf28b4a65e7a56b83e6d45b862b90eeea58c9e68be5ec72066cb856266c1e6f1cc88fd3b81a5e83964a4f98501382a77f57e4e886cad5c38b7c0b02367
-
SSDEEP
12288:MrvGqm2LZ4HRnzH4Nlu3hFeEEkRf6coz4ez2uibq5B7nKQa2o:MbG6IzGQ3GEwcoz4eqq5B7Kyo
Malware Config
Extracted
formbook
4.1
da29
kas-travel.com
hy1618.net
biosrch.com
sharvellestudio.com
56416.ooo
953700958.com
500051.com
clic.coach
veriosg.xyz
aptsafety.com
cucinaconestilo.com
sercettopper.com
diycoldplungetub.com
hostingopinion.com
mediatechnologysolutions.com
nodogwifnohat.com
ethpiee.com
tragaperrasbares.com
bbbcf.top
jtxu6.top
Targets
-
-
Target
Details of Your Etisalat Summary Bill for the Month of May-2024.exe
-
Size
1.0MB
-
MD5
5cbe85014bd3a467c5d877780b4fd2c0
-
SHA1
88153e1c9f0832e4cb30ed0e0eb013bb229fe1bc
-
SHA256
134202829433d1fb9262976ef7da28a971f219eff5acafdf294fd4425e102981
-
SHA512
e62b634e7c1d20c1860b2e11db886fc382d082a75bc1613e922904baf6c7dc655ed6b6ea40b2a4269785195a1b296e4dd20e11e3d1079ff848c021ffc9c8b276
-
SSDEEP
24576:7AHnh+eWsN3skA4RV1Hom2KXMmHaVXxRz4mmq5B/K3Zi5:Wh+ZkldoPK8YaVhR8mmqHS+
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Formbook payload
-
Adds policy Run key to start application
-
Suspicious use of SetThreadContext
-