[puzzlex]

Anyone recognizes?

[puzzlex]

C&C 1 (not sure if there were more):

http://www.bella-bg.com/private/

Looks a nifty malware, shame they do not use SSL at this level.

[Antelox]

This is FormBook form grabber.

C&C:

Code: Select all

hxxp://www.bella-bg.com/private

BR,

Antelox

[puzzlex]

You rock! BIG THANK

[puzzlex]

Control Panel:

script.zip

script.zip
(4.38 MiB) Downloaded 58 times

It is not the full panel unfortunately, config.php missing :(
Got it from: http://www.olalimpopo.com/j0g2z5t/

[tildedennis]

@moderators maybe we can rename this thread to "Formbook Form Grabber"

Couple of posts:

[*] https://www.arbornetworks.com/blog/aser ... m-grabber/
[*] https://www.fireeye.com/blog/threat-res ... aigns.html

I'm starting to see newer versions (3.2, 3.3, and 3.4) since the posts