General
-
Target
tmp
-
Size
1.5MB
-
Sample
220409-t9zh1afcam
-
MD5
a1c4645815d0ab06831f62042cfa0da0
-
SHA1
e3ce2d0fc9bd18ab30d589f052edce9ca410f2ee
-
SHA256
a03ebb1ad2450b07206923043ad865cb83e1d4798a9273704a9626854fd17399
-
SHA512
a34d0c18b833f36e0698e2396270a43ed93d5d2839fa94753ad5fa4e4bf9ec8ecfb3d38f17c0384f30dde1d838c1cf462a40f14da8f430788e5e51cd0162e020
Malware Config
Extracted
formbook
4.1
nff
shinseikai.site
creditmystartup.com
howtovvbucks.com
betterfromthebeginning.com
oubacm.com
stonalogov.com
gentrypartyof8.com
cuesticksandsupplies.com
joelsavestheday.com
llanobnb.com
ecclogic.com
miempaque.com
cai23668.com
miscdr.net
twzhhq.com
bloomandbrewcafe.com
angcomleisure.com
mafeeboutique.com
300coin.club
brooksranchhomes.com
Targets
-
-
Target
tmp
-
Size
1.5MB
-
MD5
a1c4645815d0ab06831f62042cfa0da0
-
SHA1
e3ce2d0fc9bd18ab30d589f052edce9ca410f2ee
-
SHA256
a03ebb1ad2450b07206923043ad865cb83e1d4798a9273704a9626854fd17399
-
SHA512
a34d0c18b833f36e0698e2396270a43ed93d5d2839fa94753ad5fa4e4bf9ec8ecfb3d38f17c0384f30dde1d838c1cf462a40f14da8f430788e5e51cd0162e020
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Formbook Payload
-
Looks for VirtualBox Guest Additions in registry
-
Looks for VMWare Tools registry key
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Maps connected drives based on registry
Disk information is often read in order to detect sandboxing environments.
-
Suspicious use of SetThreadContext
-