General
-
Target
44a8227ccd3bd1fb5285b84d99282b199594457c73bdab74c4cbeb331e671618
-
Size
414KB
-
Sample
220512-n4k6jadee5
-
MD5
f3becd80be8779dfeb8ca5791f7ffb86
-
SHA1
91f03335ff735cef93edafc6748d354d08eabe87
-
SHA256
44a8227ccd3bd1fb5285b84d99282b199594457c73bdab74c4cbeb331e671618
-
SHA512
f508be9b45170e7669c69ab6ec4849ddb318ee8d9a0d3ffc906197747de67b94d4c32b8aecb383fee6ce49d7e364a07743c8e3a7ed6e91132219633d65661abb
Malware Config
Extracted
formbook
4.1
kvsz
hdlivesonlinetv24.com
illaheehillsseniorliving.com
wihong.com
christopher-cost.com
huayvipee.com
csdroped.xyz
relationsvivantes.com
xmcombohome.com
qingc2.com
sunsetcinemamusic.com
anotherheadache.com
connectlcv.com
unitermi.com
cugetarileunuisarman.com
agakegois.com
burnercouture.com
ambassador-holidays.com
schnarr-design.com
2013lang.com
httattoos.com
Targets
-
-
Target
44a8227ccd3bd1fb5285b84d99282b199594457c73bdab74c4cbeb331e671618
-
Size
414KB
-
MD5
f3becd80be8779dfeb8ca5791f7ffb86
-
SHA1
91f03335ff735cef93edafc6748d354d08eabe87
-
SHA256
44a8227ccd3bd1fb5285b84d99282b199594457c73bdab74c4cbeb331e671618
-
SHA512
f508be9b45170e7669c69ab6ec4849ddb318ee8d9a0d3ffc906197747de67b94d4c32b8aecb383fee6ce49d7e364a07743c8e3a7ed6e91132219633d65661abb
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Formbook Payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Suspicious use of SetThreadContext
-