General
-
Target
2f7fe38bef137e67bf3c06eb62e4b243
-
Size
496KB
-
Sample
220706-ac31daeehr
-
MD5
2f7fe38bef137e67bf3c06eb62e4b243
-
SHA1
8ddd07f125248e6b9c97a219206ca5963a7ceeac
-
SHA256
e6507a30dc00cd8ec7b0b945c3549bcb313352e6443560394d136cb59486598e
-
SHA512
c216c86f391428e72f6aa43a264bb1480397cba2ddad8fddaf87457cefe3fd2f06804766dd3fbdfeeab7ee5ad5096405052ff7429a4a5073fffb92276bc619cd
Malware Config
Extracted
formbook
4.1
g2fg
snowcrash.website
pointman.us
newheartvalve.care
drandl.com
sandspringsramblers.com
programagubernamental.online
boja.us
mvrsnike.com
mentallyillmotherhood.com
facom.us
programagubernamental.store
izivente.com
roller-v.fr
amazonbioactives.com
metaverseapple.xyz
5gt-mobilevsverizon.com
gtwebsolutions.co
scottdunn.life
usdp.trade
pikmin.run
Targets
-
-
Target
2f7fe38bef137e67bf3c06eb62e4b243
-
Size
496KB
-
MD5
2f7fe38bef137e67bf3c06eb62e4b243
-
SHA1
8ddd07f125248e6b9c97a219206ca5963a7ceeac
-
SHA256
e6507a30dc00cd8ec7b0b945c3549bcb313352e6443560394d136cb59486598e
-
SHA512
c216c86f391428e72f6aa43a264bb1480397cba2ddad8fddaf87457cefe3fd2f06804766dd3fbdfeeab7ee5ad5096405052ff7429a4a5073fffb92276bc619cd
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Formbook Payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Suspicious use of SetThreadContext
-