General
-
Target
3614d38f71c129eda85ef01488a00a61661e3bb0c7963b15fb6a3cbffdc54ba4
-
Size
349KB
-
Sample
220521-a1vc5sbbb5
-
MD5
74cd37196f1ab70f0bcfdcd20415f1c3
-
SHA1
117d79799538cec0d682cc025c92c52db3b49a9c
-
SHA256
3614d38f71c129eda85ef01488a00a61661e3bb0c7963b15fb6a3cbffdc54ba4
-
SHA512
f3bee5eb6b147bb41321ac8ea1593556198f35919b49b9c9cbd1eb43b2d08d83930813c48a6ba6aebf4316f1e35e1a6887b025cea58b32986024db857540e789
Static task
static1
Behavioral task
behavioral1
Sample
nuovo ordine.exe
Resource
win7-20220414-en
Malware Config
Extracted
formbook
4.1
kvsz
okashyns.com
sbsgamedaejeon-two.com
drb77.com
top5dating.com
websprings.online
voizers.com
zenith.site
lahistoriade.com
qv85.com
armandonieto.com
priestvedic.com
jessandjeff.net
magic-desktop.com
jitaji.com
ldmeili.com
yuwanqingmy.com
buzhouorg.com
chaiseloungereviews.com
m2g8way.com
freespin-support.com
bocapvang.net
315px.com
eugeniobarros.tech
sif.email
xn--oorv2aj6bj7cds0d6p4b.com
polychips.com
grouptulip.win
landbank.site
bet365c.win
inbonz.com
outofthepark.today
jeaniney.com
weeip.com
dmoneylife.com
rticlubs.com
reisedating.com
marijuanadogbone.com
funippon.com
banknotesync.com
alexandre-boissard.com
valorartetattoo.com
savetheverse.com
specificpcshop.online
h0jt1y.accountant
jiqing3.com
alfaranakle.com
saft-store.com
wanderingcollective.com
santandermobi.online
557023.top
loulancaster.com
vedattelekom.com
jatinangorcity.com
goldencanaries.com
edgaralanbro.com
levelretail.com
taylorsandbek.com
upbeatnewyork.com
motoreselectricoschihuahua.com
hotair.wales
getawomantodoit.com
xiaoxiong365.com
cloudboxsupport.com
vecteur-u-shop.com
fex-tracks.com
Targets
-
-
Target
nuovo ordine.exe
-
Size
391KB
-
MD5
7d7e555fa23b77a241816576939337e7
-
SHA1
e7360c15d4cc0dc0fa3ff747b64d6c0a52e41861
-
SHA256
c37b5db790caaad96b2ae291910803a016cdae230b743bc2029a21ded85b9f03
-
SHA512
9a00f518afee39dd06ecd31f2dd7f91962570d8cb786096328478032c36df3300aa4eeff71d746bf521c6fe291144b48d005b808a44ede7beb0cadac4c138977
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Formbook Payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-