General
-
Target
f55f34179b9927413e1b8e03428219b5.zip
-
Size
314KB
-
Sample
240903-hyb3sa1akk
-
MD5
94b1b5b8e1eacfa23f3f1054a5c0681d
-
SHA1
f98206080c4bc799d25c76215a66e0c317644d0e
-
SHA256
f100b637fa8bc6f97f3bac5fe25cf5539a93c83795f0dfe22c8136282dd866a2
-
SHA512
ccea42d285053369d546e1c37d6c423c0a99efab91c2ec1736048d9d01399ea8ddfb125e3cf01d3854c7bdf00b42ea329861516bba4424517b0c371f28aa66a3
-
SSDEEP
6144:WaDT4FBp2AYx9KcnEthV11WPWr1ba9hoPxeWDr60IXses5W9wZA2J:PTIH2AYXKeEXV31ba9hoP8SM8PAaAA
Malware Config
Extracted
formbook
4.1
s6tn
ya-volna.com
nakimura.online
buildtheyamato.com
carecard.xyz
orthozayn.com
sitd.xyz
garu.club
alfainfocom.com
floridalacrossecamps.com
banytus.xyz
dogodipiskot.quest
ljlsaf.com
shaheenricemills.com
cuevieujni.info
chrisandkcollection.com
sunadokei.website
hoidotsbirky.quest
creditassociatesllc.com
amazonhrjobs.com
the-luggage-dropp-off.com
Targets
-
-
Target
9266ece6d7847e789355c680f49e4eb1fed2417e88b9fbd780e76e5f3ffcab33
-
Size
519KB
-
MD5
f55f34179b9927413e1b8e03428219b5
-
SHA1
6794de0e21b2dcf6844e6c27d7391105ee9bf1ef
-
SHA256
9266ece6d7847e789355c680f49e4eb1fed2417e88b9fbd780e76e5f3ffcab33
-
SHA512
079e23fd13c75923c1510b35b8c8559d774982a5ce991483bcb6d2e0a8f6b0870bd5eca57926acedbdfccd71249148f26e76b7fb353673c2076678f60a20570f
-
SSDEEP
6144:2i5IN9bX6qUhFFGzaX/yuWUJeLC5MiTMXp6LNXlTEGtxhezzK3iU8dEHK:2i5ID6qUbFhyAXocLNNVtuXEHK
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Formbook payload
-
Drops startup file
-
Suspicious use of SetThreadContext
-