General
-
Target
20122024_0935_RP N° UNDP-TGO-00034 TOGO.exe.iso
-
Size
1.2MB
-
Sample
241220-lkqwkavkcw
-
MD5
93a847f7c3cfa5f41d1f1460e6601600
-
SHA1
a8f28faf5ed72d9f2df1e69f43ec8d02204280eb
-
SHA256
f9dad450e0bf73796e36536b863cf68114bbe9ace324ab324741d61a88d63ea3
-
SHA512
e27298b9a04301f9b6963f068ece48b1068fdff846a375abcb38b3ea2480d5676bac3f1e9a96a35c9e73b7d5af1791872242dc0b50cdaa969133592a4165802a
-
SSDEEP
24576:WqDEvCTbMWu7rQYlBQcBiT6rprG8aQTZ1IaWE1c4+vrcJ:WTvC/MTQYxsWR7aQTZWE1c4Crc
Malware Config
Extracted
formbook
4.1
at22
etween-us.online
sphaleia.net
ental-implants-78350.bond
q4a.lat
commerce-97292.bond
linds-curtains-38811.bond
gyptevoyages.net
landofigueroa-abogados.net
cuitis.xyz
hantom.city
yzk.online
afikabmedan.store
ome-remodeling-67289.bond
ebpage-klzdxrhnazi.shop
eject.lol
rismart.xyz
nfluencer-marketing-72407.bond
ksolotl.xyz
ebsbayrntilrmizin93.xyz
pps-75399.bond
Targets
-
-
Target
RP N° UNDP-TGO-00034 TOGO.exe
-
Size
1.1MB
-
MD5
5c64f75360a7535d0098e24852069970
-
SHA1
462d562bf08435260c76d09b8d0e78c8c854f55f
-
SHA256
6ce7f8a8cbb441eb6ea7b37a9f8039142f6586311cdc6c0518c1265ecb78318a
-
SHA512
293ae523ddfae0e68729bcf363efee2bf29586e720bd715c5d15cafbc2d38b62c86a21873ee41157e3cfd065f2865db07aa61eae65e19e6b5d416793d76ea7e8
-
SSDEEP
24576:ZqDEvCTbMWu7rQYlBQcBiT6rprG8aQTZ1IaWE1c4+vrcJ:ZTvC/MTQYxsWR7aQTZWE1c4Crc
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Formbook family
-
Formbook payload
-
Suspicious use of SetThreadContext
-