General
-
Target
Scan0186460022.exe
-
Size
28KB
-
Sample
220324-dqbptsgafk
-
MD5
4fcb4c25f8c90512688e83cdc8daf8b3
-
SHA1
256bb873dcfa16fade3e911cb348b217df8b389f
-
SHA256
1668071dae27e79c5de1abc1d04e278ce9ffe980fd36fa194e9d32ab00ac6831
-
SHA512
f6544e3212c721d93d631dc9b9d367080383bc9b036cf1fd7a4cccf5c53b6c6118d922607aee109f28a4c3342bc0763791c968f4b721a2774c7ba800b68fc70e
Malware Config
Extracted
formbook
4.1
oh75
denizgidam.com
6cc06.com
charlottewaldburgzeil.com
medijanus.com
qingdaoyiersan.com
datcabilgisayar.xyz
111439d.com
xn--1ruo40k.com
wu6enxwcx5h3.xyz
vnscloud.net
brtka.xyz
showztime.com
promocoesdedezenbro.com
wokpy.com
chnowuk.online
rockshotscafe.com
pelrjy.com
nato-riness.com
feixiang-chem.com
thcoinexchange.com
Targets
-
-
Target
Scan0186460022.exe
-
Size
28KB
-
MD5
4fcb4c25f8c90512688e83cdc8daf8b3
-
SHA1
256bb873dcfa16fade3e911cb348b217df8b389f
-
SHA256
1668071dae27e79c5de1abc1d04e278ce9ffe980fd36fa194e9d32ab00ac6831
-
SHA512
f6544e3212c721d93d631dc9b9d367080383bc9b036cf1fd7a4cccf5c53b6c6118d922607aee109f28a4c3342bc0763791c968f4b721a2774c7ba800b68fc70e
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Formbook Payload
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-