General
-
Target
ffd00dd8cf8920277ee6532aeb7f2321c3c798f5e2987c9dae8bcf6e3cc3a0b2
-
Size
314KB
-
Sample
240903-ygl5eswere
-
MD5
263387100fe0f4ececfea6baab0bf543
-
SHA1
04a032b81fa403cb4366936a2addd05633912396
-
SHA256
ffd00dd8cf8920277ee6532aeb7f2321c3c798f5e2987c9dae8bcf6e3cc3a0b2
-
SHA512
086399b41c82988be5cdecc718939e55259ea489de7ecb7d3eb1198db97cc0550451a11290c0b9d2aa2d61b28c8173792ff47b0d6d1b9ff700847ad350121a72
-
SSDEEP
6144:5Zf30xxdcWlQyJOF+vDaySrjWtvFEgYrGjAhXSGbGK/HoPOOhXQdI+e2:T3qjQh+ve7AvFYrsAhXSpK/IGOOdI+e2
Malware Config
Extracted
formbook
4.1
s6tn
ya-volna.com
nakimura.online
buildtheyamato.com
carecard.xyz
orthozayn.com
sitd.xyz
garu.club
alfainfocom.com
floridalacrossecamps.com
banytus.xyz
dogodipiskot.quest
ljlsaf.com
shaheenricemills.com
cuevieujni.info
chrisandkcollection.com
sunadokei.website
hoidotsbirky.quest
creditassociatesllc.com
amazonhrjobs.com
the-luggage-dropp-off.com
Targets
-
-
Target
3c002d7d7bfb83b56c94765d3f1cd9182993dabe4442e8f506fbe76334a01995
-
Size
519KB
-
MD5
9eeccc9b585e1ffdf53b20b3d4f4505d
-
SHA1
22c8124ad3ad4f39eba59ceae42a1f056b6f7279
-
SHA256
3c002d7d7bfb83b56c94765d3f1cd9182993dabe4442e8f506fbe76334a01995
-
SHA512
b19405394b04161ae616f068390df72b11fafd71c03626a081f10c72e77dba158a20baf247c481d34702e72f9b4eedd763e9e7506969ce28289219ff494ba38a
-
SSDEEP
6144:2i5IN9bX6qUhFFGzaX/yuWUJeLC5MiTMXp6LNXlTEGtxhezzK3iU8dEHm:2i5ID6qUbFhyAXocLNNVtuXEHm
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Formbook payload
-
Drops startup file
-
Suspicious use of SetThreadContext
-