General
-
Target
Ordem de Compra pdf.exe
-
Size
726KB
-
Sample
220211-h419vseaap
-
MD5
d523d339c70d176e821a236e713a20d6
-
SHA1
3127bd7038abe85c3f41139f7dab79fa4c849451
-
SHA256
e9f29862ff2acf2bf4ca90262d717a32ed3236656081e6014e9b55d962707c1f
-
SHA512
ad7e1458b985c855bfef6dd85e3899e8a311166d807919949cc5b56904acf9703501aaaad257c630887f9a4617c505d578f0ae2083fbc0e638b99f58755a5155
Malware Config
Extracted
formbook
4.1
g2m3
stocktonfingerprinting.com
metaaiqr.com
junicy.com
libertymutualgrou.com
jklhs7gl.xyz
alex-covalcova.space
socialfiguild.com
drnicholasreid.com
androidappprogrammierie.com
relatingtohumans.com
jitsystems.com
gbwpmz.com
lesaventuresdecocomango.com
wu8ggqdv077p.xyz
autnvg.com
wghakt016.xyz
lagosian.store
hilldoor.com
oculos-ajustavel-br.xyz
nameniboothac.com
Targets
-
-
Target
Ordem de Compra pdf.exe
-
Size
726KB
-
MD5
d523d339c70d176e821a236e713a20d6
-
SHA1
3127bd7038abe85c3f41139f7dab79fa4c849451
-
SHA256
e9f29862ff2acf2bf4ca90262d717a32ed3236656081e6014e9b55d962707c1f
-
SHA512
ad7e1458b985c855bfef6dd85e3899e8a311166d807919949cc5b56904acf9703501aaaad257c630887f9a4617c505d578f0ae2083fbc0e638b99f58755a5155
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Formbook Payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Suspicious use of SetThreadContext
-