General
-
Target
315e737738df8faaeeb36c8fb6c692a18179675dcd4648a1dc982678e46f8f7c
-
Size
733KB
-
Sample
220511-rf8hpscbep
-
MD5
a2225e6ddb8ca51732c83c66f1af9f6f
-
SHA1
bb49ebe5e22ffb213d5f25f8c4dbafff6487ab66
-
SHA256
315e737738df8faaeeb36c8fb6c692a18179675dcd4648a1dc982678e46f8f7c
-
SHA512
18414dff21d71926cc20148efae5f45b49b1a3550dedaad911f1f5f4dc8e91626f6b2610a9801fd3fca5285a6329277714cae52b9c7cba31a276f0f0fd3b3376
Malware Config
Extracted
formbook
4.1
kvsz
hdlivesonlinetv24.com
illaheehillsseniorliving.com
wihong.com
christopher-cost.com
huayvipee.com
csdroped.xyz
relationsvivantes.com
xmcombohome.com
qingc2.com
sunsetcinemamusic.com
anotherheadache.com
connectlcv.com
unitermi.com
cugetarileunuisarman.com
agakegois.com
burnercouture.com
ambassador-holidays.com
schnarr-design.com
2013lang.com
httattoos.com
Targets
-
-
Target
315e737738df8faaeeb36c8fb6c692a18179675dcd4648a1dc982678e46f8f7c
-
Size
733KB
-
MD5
a2225e6ddb8ca51732c83c66f1af9f6f
-
SHA1
bb49ebe5e22ffb213d5f25f8c4dbafff6487ab66
-
SHA256
315e737738df8faaeeb36c8fb6c692a18179675dcd4648a1dc982678e46f8f7c
-
SHA512
18414dff21d71926cc20148efae5f45b49b1a3550dedaad911f1f5f4dc8e91626f6b2610a9801fd3fca5285a6329277714cae52b9c7cba31a276f0f0fd3b3376
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Formbook Payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Suspicious use of SetThreadContext
-