General
-
Target
PO# 4415902670.exe
-
Size
542KB
-
Sample
201126-sqdvv654ge
-
MD5
058e6f06a51e22bbc975eecf35c34844
-
SHA1
638f4727a99bb389e8e6a77c4fbee17bdc19fc60
-
SHA256
ad644da69f848609475d2a3d773eadf646d4c1e1cb20e4b87422d224e2ccbe32
-
SHA512
0b04ed15c05b5c5791c8cc5478219e82e9f5def8d9d4f445ef03f3b39a8a76b7e28e7312914624c35b578a74927230e5e0f52c2039cd45db0047da255e15669e
Malware Config
Extracted
formbook
http://www.klingenwacht.com/mlg/
xintianpx.com
chrispsheehan.com
sensationallyot.com
veloceda.com
fanoosbattery.com
wenda7.com
cultivatecultura.com
mersinci.com
makeupbrushhes.com
vptexpediters.com
hispoemin.com
mikeshouseofathousandlegs.com
dealclosersplayback.com
knightdalesleeps.com
1uprealestate.com
showeraccessory.com
perthpanelbeaters.com
novergi.com
directmultiservice.com
mi-miftahurrohmah.com
Targets
-
-
Target
PO# 4415902670.exe
-
Size
542KB
-
MD5
058e6f06a51e22bbc975eecf35c34844
-
SHA1
638f4727a99bb389e8e6a77c4fbee17bdc19fc60
-
SHA256
ad644da69f848609475d2a3d773eadf646d4c1e1cb20e4b87422d224e2ccbe32
-
SHA512
0b04ed15c05b5c5791c8cc5478219e82e9f5def8d9d4f445ef03f3b39a8a76b7e28e7312914624c35b578a74927230e5e0f52c2039cd45db0047da255e15669e
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Suspicious use of NtCreateProcessExOtherParentProcess
-
Formbook Payload
-
Suspicious use of SetThreadContext
-