General
-
Target
SecuriteInfo.com.Trojan.Inject4.6535.29715.6231
-
Size
863KB
-
Sample
210111-25m5pb5nnn
-
MD5
60725c18462afc8dff3672065c92d140
-
SHA1
04189cc5433a440b472a19b05e6183857640dd88
-
SHA256
9dddc8004c534fb2ebb6ad63cd96c11a97d87c87c1fc8eb46a6df36ecc341c18
-
SHA512
acaca0430516ea030c7cbdff2ee2ebc1b65aaf6b1716b710c4ddcf0b324fa7b1da4a87eb7199beeaac4316e17db8651a51e1d4042f293a88ea544d9c7e9ccac5
Malware Config
Extracted
formbook
http://www.thesiromiel.com/kgw/
valentinakasu.com
soyelmatador.com
collaborativeprosperity.com
power8brokers.com
nexus-ink.com
manpasandmeatmarket.com
the-ethical-forums.today
maryannpark.com
bikininbodymommy.com
pxwuo.com
bigbangmerch.com
okaysinger.com
shopcarpe.com
rainbowhillsswimclub.com
crifinmarket.com
ebl-play.net
forceandsonsequipment.com
viagraytqwi.com
latashashop.com
suffocatinglymundanepodcast.com
Targets
-
-
Target
SecuriteInfo.com.Trojan.Inject4.6535.29715.6231
-
Size
863KB
-
MD5
60725c18462afc8dff3672065c92d140
-
SHA1
04189cc5433a440b472a19b05e6183857640dd88
-
SHA256
9dddc8004c534fb2ebb6ad63cd96c11a97d87c87c1fc8eb46a6df36ecc341c18
-
SHA512
acaca0430516ea030c7cbdff2ee2ebc1b65aaf6b1716b710c4ddcf0b324fa7b1da4a87eb7199beeaac4316e17db8651a51e1d4042f293a88ea544d9c7e9ccac5
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Formbook Payload
-
Looks for VirtualBox Guest Additions in registry
-
Looks for VMWare Tools registry key
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Uses the VBS compiler for execution
-
Maps connected drives based on registry
Disk information is often read in order to detect sandboxing environments.
-
Suspicious use of SetThreadContext
-