General
-
Target
e045a1c03a7c10a04018920e7a5b656c.exe
-
Size
898KB
-
Sample
210115-l7bdcdl8b6
-
MD5
e045a1c03a7c10a04018920e7a5b656c
-
SHA1
2c960252095bce6b2de024b9e1a7114d5ca8de55
-
SHA256
623c65639a4364546031c5edb9780ab9cbbe5e6713d09518805dcaded8e425a0
-
SHA512
85e19f67e0f49389334815cc865dc216fd19729bc18f4f00c05ba75469ddbc9bf5191db284605ccf03f2f1806948196dc7323b484effc4791e28d2c9865a9fed
Malware Config
Extracted
formbook
http://www.thesiromiel.com/kgw/
valentinakasu.com
soyelmatador.com
collaborativeprosperity.com
power8brokers.com
nexus-ink.com
manpasandmeatmarket.com
the-ethical-forums.today
maryannpark.com
bikininbodymommy.com
pxwuo.com
bigbangmerch.com
okaysinger.com
shopcarpe.com
rainbowhillsswimclub.com
crifinmarket.com
ebl-play.net
forceandsonsequipment.com
viagraytqwi.com
latashashop.com
suffocatinglymundanepodcast.com
Targets
-
-
Target
e045a1c03a7c10a04018920e7a5b656c.exe
-
Size
898KB
-
MD5
e045a1c03a7c10a04018920e7a5b656c
-
SHA1
2c960252095bce6b2de024b9e1a7114d5ca8de55
-
SHA256
623c65639a4364546031c5edb9780ab9cbbe5e6713d09518805dcaded8e425a0
-
SHA512
85e19f67e0f49389334815cc865dc216fd19729bc18f4f00c05ba75469ddbc9bf5191db284605ccf03f2f1806948196dc7323b484effc4791e28d2c9865a9fed
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Formbook Payload
-
Looks for VirtualBox Guest Additions in registry
-
Looks for VMWare Tools registry key
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Maps connected drives based on registry
Disk information is often read in order to detect sandboxing environments.
-
Suspicious use of SetThreadContext
-