General
-
Target
e4d2c7462fe52eac23f88b482194083439cf69d48be74b3514ea804be68fff7e
-
Size
300KB
-
Sample
220521-cdsxxaggbm
-
MD5
ca6079299759a32eb07836b21005a3db
-
SHA1
6ac0286e10afa9a43e029ebbba98295941829fbd
-
SHA256
e4d2c7462fe52eac23f88b482194083439cf69d48be74b3514ea804be68fff7e
-
SHA512
b7aa587a6d83ec308d71265daf4d700a966c0dae7d72d239e812d8db11011d288e1ce39e96f344b503eeb1a2faf7fd3a2b46c452de2963fc4355854b21b925ce
Malware Config
Extracted
formbook
3.9
rmj
arksarto.com
immigrationlawyersanjose.com
o60q2.com
my-mind-impulse.com
tenkai.info
southgeorgiaroofs.com
seo.ltd
joinpznow.today
acow.ltd
psychologue-paysdegex.com
ameenuzpg.com
iddua.com
jsfvat.info
fatalsdetale.online
91javac.com
racheldinwiddie.com
kedipvps.com
kinmeginme.com
greatarmor.com
golden.solar
Targets
-
-
Target
Payment transfer.exe
-
Size
317KB
-
MD5
96106d8d331a6f9c135c1f81bb82d9fe
-
SHA1
7e59ba122d299460504be159a862faeaf2f80491
-
SHA256
293f8c9b635a869a00e4f0d275c8a3e8f358242e4813e443282cbc5ceb8f099d
-
SHA512
87309e2ed58c1d5b257a73abb1332c0faf36c98972840487b2388d7dd96ed1805d06bcafd831f36c980b1fd1283ff54636f885eaa9e4797fb7d19387144af4d3
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
suricata: ET MALWARE FormBook CnC Checkin (POST) M2
suricata: ET MALWARE FormBook CnC Checkin (POST) M2
-
Formbook Payload
-
Looks for VirtualBox Guest Additions in registry
-
Adds policy Run key to start application
-
Looks for VMWare Tools registry key
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Deletes itself
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application
-
Maps connected drives based on registry
Disk information is often read in order to detect sandboxing environments.
-
Suspicious use of SetThreadContext
-