General
-
Target
11649edf97c44a364aa23ec2d01a39ed40efe81f025120a621b36c696620b441
-
Size
684KB
-
Sample
220705-31yd1sgdf7
-
MD5
740b8adc5e7f9270a38b417cd0715466
-
SHA1
b0d06572cb5f3e2fddf8322fbdbf40ae1ac379d0
-
SHA256
11649edf97c44a364aa23ec2d01a39ed40efe81f025120a621b36c696620b441
-
SHA512
0529c1eb5f5ee0db2e716d723941d49ceffc310b021224c4769e5801b9f5d3a5dda48115fc82bf24b920eedf20520bebe26d822c98cf5bc82acf03e0f4e6ec24
Malware Config
Extracted
formbook
4.1
g2fg
snowcrash.website
pointman.us
newheartvalve.care
drandl.com
sandspringsramblers.com
programagubernamental.online
boja.us
mvrsnike.com
mentallyillmotherhood.com
facom.us
programagubernamental.store
izivente.com
roller-v.fr
amazonbioactives.com
metaverseapple.xyz
5gt-mobilevsverizon.com
gtwebsolutions.co
scottdunn.life
usdp.trade
pikmin.run
Targets
-
-
Target
11649edf97c44a364aa23ec2d01a39ed40efe81f025120a621b36c696620b441
-
Size
684KB
-
MD5
740b8adc5e7f9270a38b417cd0715466
-
SHA1
b0d06572cb5f3e2fddf8322fbdbf40ae1ac379d0
-
SHA256
11649edf97c44a364aa23ec2d01a39ed40efe81f025120a621b36c696620b441
-
SHA512
0529c1eb5f5ee0db2e716d723941d49ceffc310b021224c4769e5801b9f5d3a5dda48115fc82bf24b920eedf20520bebe26d822c98cf5bc82acf03e0f4e6ec24
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Formbook Payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Suspicious use of SetThreadContext
-