General
-
Target
3c6adb5b605742923615e51b5c8207469af94866c4826194c840cdada471acfe
-
Size
1.0MB
-
Sample
220703-jc7s1acfa6
-
MD5
5d4e7061075e5bbcf61a8a23da4c0af9
-
SHA1
1f94e1b52c21eaa213a9e7aa0567e303ad04280e
-
SHA256
3c6adb5b605742923615e51b5c8207469af94866c4826194c840cdada471acfe
-
SHA512
a72766fae8ea3d2d7922e494aeeb30a6bae087f483fe076f4aff9875ee8d4c4bf32f1b933a3f0be305684a439eec357ec2c8b242ca4d977aa802539509fa0c96
Malware Config
Extracted
lokibot
http://zenshinonline.ru/mine/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Extracted
formbook
3.8
sx
wtcoms.com
pinkrabbitcollectivestore.com
elmcitywinds.net
emhlk.com
youwellbeingcentre.com
vtujy.info
clarinnautico.com
stschwartzart.com
vrreference.com
loganitaly.com
godalmingflutetuition.com
dontboogovote.com
osakiseikotsuin.com
mykokodajourney.com
manukaaustralia.online
zadarcarhire.com
service56.net
vetc-conseils.com
lumincarecenter.com
endosx.com
Targets
-
-
Target
3c6adb5b605742923615e51b5c8207469af94866c4826194c840cdada471acfe
-
Size
1.0MB
-
MD5
5d4e7061075e5bbcf61a8a23da4c0af9
-
SHA1
1f94e1b52c21eaa213a9e7aa0567e303ad04280e
-
SHA256
3c6adb5b605742923615e51b5c8207469af94866c4826194c840cdada471acfe
-
SHA512
a72766fae8ea3d2d7922e494aeeb30a6bae087f483fe076f4aff9875ee8d4c4bf32f1b933a3f0be305684a439eec357ec2c8b242ca4d977aa802539509fa0c96
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
-
Formbook Payload
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles
-