General
-
Target
2541cb8ee7e04e3d513aed86765198ad
-
Size
535KB
-
Sample
220705-1d6qrsfbd8
-
MD5
2541cb8ee7e04e3d513aed86765198ad
-
SHA1
657a8664f4e0d49e346c68ab063adb50d6e85a09
-
SHA256
8b70ca4638fa94692c4c816a5e6d78dbf4b714d729cf76b6408080b4a33cb80e
-
SHA512
514bd4f13af25a404e30657e89d1bbfb8a53a86a499cb33ca456bb4140631a8ddeec412106466f5d77b8210a743c6481fe1441fbd126c872d26835e0d6a99705
Malware Config
Extracted
formbook
4.1
g2fg
snowcrash.website
pointman.us
newheartvalve.care
drandl.com
sandspringsramblers.com
programagubernamental.online
boja.us
mvrsnike.com
mentallyillmotherhood.com
facom.us
programagubernamental.store
izivente.com
roller-v.fr
amazonbioactives.com
metaverseapple.xyz
5gt-mobilevsverizon.com
gtwebsolutions.co
scottdunn.life
usdp.trade
pikmin.run
Targets
-
-
Target
2541cb8ee7e04e3d513aed86765198ad
-
Size
535KB
-
MD5
2541cb8ee7e04e3d513aed86765198ad
-
SHA1
657a8664f4e0d49e346c68ab063adb50d6e85a09
-
SHA256
8b70ca4638fa94692c4c816a5e6d78dbf4b714d729cf76b6408080b4a33cb80e
-
SHA512
514bd4f13af25a404e30657e89d1bbfb8a53a86a499cb33ca456bb4140631a8ddeec412106466f5d77b8210a743c6481fe1441fbd126c872d26835e0d6a99705
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Formbook Payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Suspicious use of SetThreadContext
-