General
-
Target
0e6d87f5bd5e0fc8d8ecd6949623ef02.exe
-
Size
1.1MB
-
Sample
210111-rb722rfntx
-
MD5
0e6d87f5bd5e0fc8d8ecd6949623ef02
-
SHA1
4df7241a27077b6bbd8cc69efb103edb8d46cf92
-
SHA256
2fd6b2288864f3a099a32bd923f7b3c67db00c979aa2e46db125e104618e92b7
-
SHA512
8c7ab60be0fd184090c473c9759c253d054d343bf271d9ea04444e8219f82fdf63668a2d9d6d5a3851320f9624ed5087e51c30cd547f2b4ded65fed85dc57ee8
Malware Config
Extracted
formbook
http://www.thesiromiel.com/kgw/
valentinakasu.com
soyelmatador.com
collaborativeprosperity.com
power8brokers.com
nexus-ink.com
manpasandmeatmarket.com
the-ethical-forums.today
maryannpark.com
bikininbodymommy.com
pxwuo.com
bigbangmerch.com
okaysinger.com
shopcarpe.com
rainbowhillsswimclub.com
crifinmarket.com
ebl-play.net
forceandsonsequipment.com
viagraytqwi.com
latashashop.com
suffocatinglymundanepodcast.com
Targets
-
-
Target
0e6d87f5bd5e0fc8d8ecd6949623ef02.exe
-
Size
1.1MB
-
MD5
0e6d87f5bd5e0fc8d8ecd6949623ef02
-
SHA1
4df7241a27077b6bbd8cc69efb103edb8d46cf92
-
SHA256
2fd6b2288864f3a099a32bd923f7b3c67db00c979aa2e46db125e104618e92b7
-
SHA512
8c7ab60be0fd184090c473c9759c253d054d343bf271d9ea04444e8219f82fdf63668a2d9d6d5a3851320f9624ed5087e51c30cd547f2b4ded65fed85dc57ee8
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Formbook Payload
-
Looks for VirtualBox Guest Additions in registry
-
Looks for VMWare Tools registry key
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Maps connected drives based on registry
Disk information is often read in order to detect sandboxing environments.
-
Suspicious use of SetThreadContext
-