General
-
Target
8b5a115dc811f2af819f81f5318efcd50916b2c6b705c4479f57006b9e7b9ad4
-
Size
725KB
-
Sample
240925-psqsbayerf
-
MD5
f29e74354a5ff52e8799a6cfb8a31668
-
SHA1
1343eefb417f27ef0d04b88130742d91fa425f1c
-
SHA256
8b5a115dc811f2af819f81f5318efcd50916b2c6b705c4479f57006b9e7b9ad4
-
SHA512
13f3224143d60fd1bd2ca0642abb1b1d97b00ca25d164b724decc55bfcbccf161d56b5f98857ec65ceb9ed759c2f29bf09376ffa506e7492ce1c6e289cb4495d
-
SSDEEP
12288:VYWVlBihvnYEnKdpvlRp5Ajlm6t+KGJfTbQwH9+XkxYBWRHWk/nFwM8NC+PT4dLQ:VbwZADND5ABm6tlqfTbRQ0q4E1NbT4lQ
Malware Config
Extracted
formbook
4.1
e62s
ellinksa.shop
uckyspinph.xyz
owdark.net
arriage-therapy-72241.bond
w7ijko4rv4p97b.top
heirbuzzwords.buzz
aspart.shop
ctivemail5-kagoya-com.info
shacertification9.shop
zitcd65k3.buzz
llkosoi.info
ru8.info
rhgtrdjdjykyetrdjftd.buzz
yschoollist.kiwi
oftfolio.online
rograma-de-almacen-2.online
oudoarms.top
mwquas.xyz
orjagaucha.website
nlinechat-mh.online
Targets
-
-
Target
New PO#634100636941 - 25 SEP 2024.exe
-
Size
1.0MB
-
MD5
3f3764a227cbaa066e1cfd4cf58e0d95
-
SHA1
9505108a970f6c56eebae861774889513058a333
-
SHA256
925d17bb04595884ea9ff7ef56ea7edcafd167ebbb9d24f6b9afef8816eb990b
-
SHA512
c449793821e7bc88f7e3dd7e78db88f33d0f40c3b60d7f224a69700fb4bcfd6f3336f22891c8e776e0b333e983f94756395354e82c9bed36148f21bd4235e642
-
SSDEEP
24576:8RmJkcoQricOIQxiZY1iaAHZVYzdb8qASJN7ChaNKuY:pJZoQrbTFZY1iaAHZVYBxG
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Formbook payload
-
Suspicious use of SetThreadContext
-