General
-
Target
MTIR22024323_0553381487_20220112120005.vbs
-
Size
77KB
-
Sample
220113-qrty1saea9
-
MD5
564601676bee71f5f61a44ef170d92a6
-
SHA1
76fca984dab2358e66524172e04a3528f33d8e18
-
SHA256
5e12314df61fd39cad151a41fb0d3188e437c591fa7498f09f103dea4a46f141
-
SHA512
a9b778cd8bb8684c9f7f7e0b9d79d17c2b0fab326fbfd59f818c7aaa403bf3fc67cf9944b2149b17e742feff9217c2a2ed3f18e15a8be82dbd4b709f5b86fe1d
Malware Config
Extracted
formbook
4.1
wk3t
cherrykidzclub.com
n104w16417dongesbayrd.info
pronetheus.com
tukarbelanjadapatemas.com
commlike.info
securityhackersteam.com
rainbowhitch.com
nursesgrowhealth.com
discontinuanceanywhere.com
comprehensivetitle.site
astrostorytell.store
bighorncountymtjail.com
tetoda.xyz
derivedflame.online
staging-api-projectstanley.com
mcxca.com
thebluefellowsnft.com
arizonakissesco.com
prototypephase.com
aprillemack.com
Targets
-
-
Target
MTIR22024323_0553381487_20220112120005.vbs
-
Size
77KB
-
MD5
564601676bee71f5f61a44ef170d92a6
-
SHA1
76fca984dab2358e66524172e04a3528f33d8e18
-
SHA256
5e12314df61fd39cad151a41fb0d3188e437c591fa7498f09f103dea4a46f141
-
SHA512
a9b778cd8bb8684c9f7f7e0b9d79d17c2b0fab326fbfd59f818c7aaa403bf3fc67cf9944b2149b17e742feff9217c2a2ed3f18e15a8be82dbd4b709f5b86fe1d
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Formbook Payload
-
Adds policy Run key to start application
-
Checks QEMU agent file
Checks presence of QEMU agent, possibly to detect virtualization.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application
-
Suspicious use of NtCreateThreadExHideFromDebugger
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
Suspicious use of SetThreadContext
-