General
-
Target
vbc.exe
-
Size
879KB
-
Sample
211117-sb6c8adae9
-
MD5
ec0b0a40c161fcf38f749cfbbe713d2b
-
SHA1
91c8db93ea8106afe01e6a152fe3cbd55b3b4f18
-
SHA256
48667ddc42d9eadc23dddc65f60f0de6e58afb6857953f282f7b02c115e9eed4
-
SHA512
2ca60e1f3d5bad7460a842a7bcbbf9d9f66ce574fbc54d5d68f5778e867e2129e585ada4b7c1d9d004e189309290dabced928903d159b5ad20368306ea1b827e
Malware Config
Extracted
formbook
4.1
og2w
http://www.wakecountyrealtyexpert.com/og2w/
patriotxf.com
thecreagles.com
riverdenim.com
cybqo.com
zzfangnan.com
empowerhis.com
resiliencewearmiami.com
myticketly.com
pistachio.land
13055.club
millennialsofacertainage.com
jnxdsgc.com
pixelsandplastic.digital
bugroster.com
chargedockz.com
gzyazsp.com
sintec-consultores.com
pourtonmobile.com
upmhss.com
amkanalrajhi.com
Targets
-
-
Target
vbc.exe
-
Size
879KB
-
MD5
ec0b0a40c161fcf38f749cfbbe713d2b
-
SHA1
91c8db93ea8106afe01e6a152fe3cbd55b3b4f18
-
SHA256
48667ddc42d9eadc23dddc65f60f0de6e58afb6857953f282f7b02c115e9eed4
-
SHA512
2ca60e1f3d5bad7460a842a7bcbbf9d9f66ce574fbc54d5d68f5778e867e2129e585ada4b7c1d9d004e189309290dabced928903d159b5ad20368306ea1b827e
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Formbook Payload
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Uses the VBS compiler for execution
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-