General
-
Target
deed11e2b4b23dbe0c9ef99b5390bd6f.exe
-
Size
708KB
-
Sample
210113-2tl1y1h9vn
-
MD5
deed11e2b4b23dbe0c9ef99b5390bd6f
-
SHA1
158662003b5e63c1419267d5e8b0d4ce79e72081
-
SHA256
326090842ee6d692e02ae131a2003658939f60e79bceb7bad983cfe16400062f
-
SHA512
380a473f9e6ce25e5e68ac15794d1bcbe125a887067a48c258abb625b96080d90fad32cb860043af4b32d4d8afc84365726e4a861ec03976a6bec7651d3e0380
Malware Config
Extracted
formbook
http://www.thesiromiel.com/kgw/
valentinakasu.com
soyelmatador.com
collaborativeprosperity.com
power8brokers.com
nexus-ink.com
manpasandmeatmarket.com
the-ethical-forums.today
maryannpark.com
bikininbodymommy.com
pxwuo.com
bigbangmerch.com
okaysinger.com
shopcarpe.com
rainbowhillsswimclub.com
crifinmarket.com
ebl-play.net
forceandsonsequipment.com
viagraytqwi.com
latashashop.com
suffocatinglymundanepodcast.com
Targets
-
-
Target
deed11e2b4b23dbe0c9ef99b5390bd6f.exe
-
Size
708KB
-
MD5
deed11e2b4b23dbe0c9ef99b5390bd6f
-
SHA1
158662003b5e63c1419267d5e8b0d4ce79e72081
-
SHA256
326090842ee6d692e02ae131a2003658939f60e79bceb7bad983cfe16400062f
-
SHA512
380a473f9e6ce25e5e68ac15794d1bcbe125a887067a48c258abb625b96080d90fad32cb860043af4b32d4d8afc84365726e4a861ec03976a6bec7651d3e0380
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Formbook Payload
-
Looks for VirtualBox Guest Additions in registry
-
Looks for VMWare Tools registry key
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Maps connected drives based on registry
Disk information is often read in order to detect sandboxing environments.
-
Suspicious use of SetThreadContext
-