General
-
Target
80d967b707bb161f63ea1f4dd4b18ca3bea87e5ccc1ecfbbafe1ce251eaf2386
-
Size
548KB
-
Sample
220706-r5ksyadhdk
-
MD5
52b4ab184953eb0206a26c7b6da611f9
-
SHA1
3efe986b907a864ea964fcf82a428dd36ef01b40
-
SHA256
80d967b707bb161f63ea1f4dd4b18ca3bea87e5ccc1ecfbbafe1ce251eaf2386
-
SHA512
edc5200e160898142f436ba8403247501e9c7e0e98a7876797c0e0d3dfc1bcd9cfb5656fd44007c7d5b5ab9aa1ef2550df1d8e677c2d53082dd4b92b404e6a60
Static task
static1
Behavioral task
behavioral1
Sample
80d967b707bb161f63ea1f4dd4b18ca3bea87e5ccc1ecfbbafe1ce251eaf2386.exe
Resource
win7-20220414-en
Malware Config
Extracted
formbook
4.1
de08
retirecloudyyard.com
fabiyan.xyz
chrisarlyde.com
selapex.com
vivalosgales.com
specialty-medicine.com
contasesolucoes.com
satunusanews.net
allyibc.com
alameda1876.com
artofdala.com
yukoidusp.xyz
steeldrumbandnearme.com
stonewedgetechnology.com
kentonai.com
macquarie-private.com
ddgwy.com
megagreenhousekits.com
descomplicaomarketing.com
inclusiverealtor.com
themummyfront.club
computerfashiondesigns.com
ericparlatore.com
whathappened2me.com
baksomail.xyz
mugupplatform.com
shopsolutely.com
gymcservices.com
qianshunchina.com
zoomsbshab.icu
esrmtech.com
966211.com
stockinsidepr.com
df-wh.com
smartshopapps.com
kayseriadsl.com
acedesserts.com
205qs.com
ei8i.com
aibtly.com
kpviewllc.net
nnehandebol.com
torontonianapparel.ca
therealgoldenganjagang.com
mingxiang99.com
rewkagcompany.xyz
ahmee4.com
valen.info
vacuumfun.parts
fabiyan.xyz
psncareersolutions.com
escobargroups.com
michigandice.com
ey3solutions.com
li-n.info
puingkehancuran.xyz
bilt-green.com
dfysuitetech.xyz
abdoomar.com
actsaka.xyz
justsweatitout.com
axabank.life
billyyaka.com
mypatchtools.com
epulsive.com
Targets
-
-
Target
80d967b707bb161f63ea1f4dd4b18ca3bea87e5ccc1ecfbbafe1ce251eaf2386
-
Size
548KB
-
MD5
52b4ab184953eb0206a26c7b6da611f9
-
SHA1
3efe986b907a864ea964fcf82a428dd36ef01b40
-
SHA256
80d967b707bb161f63ea1f4dd4b18ca3bea87e5ccc1ecfbbafe1ce251eaf2386
-
SHA512
edc5200e160898142f436ba8403247501e9c7e0e98a7876797c0e0d3dfc1bcd9cfb5656fd44007c7d5b5ab9aa1ef2550df1d8e677c2d53082dd4b92b404e6a60
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Formbook Payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Suspicious use of SetThreadContext
-