General
-
Target
SecuriteInfo.com.Trojan.Olock.1.19122.10072
-
Size
450KB
-
Sample
220719-s8rlbsfhhj
-
MD5
0c7194673ca5c213b88c8696d285d205
-
SHA1
d4575c2ea9fc7bc24ca086f403d132b70167cc49
-
SHA256
b1313b8c8d249728b5fe9756332a98c1415468df5f7001f2c1e4c26826edb83e
-
SHA512
a0732717dab0521c73fd6668053311cc96d82176f71b82cbcf91bd484c9cf7803fdde0a42960af338f8aa6b5be505dff71a94c18283c7838b2c0e7cd36821f1c
Malware Config
Extracted
formbook
4.1
t19g
playstationspiele.com
cakesbyannal.com
racepin.space
anti-offender.com
magnetque.com
farragorealtybrokerage.com
khuludmohammed.com
v33696.com
84ggg.com
d440.com
soccersmarthome.com
ofthis.world
fivestaryardcards.com
lusyard.com
gghft.com
viajesfortur.com
rationalirrationality.com
hanaramenrestaurant.com
exactlycleanse.com
martensenargentina.com
Targets
-
-
Target
SecuriteInfo.com.Trojan.Olock.1.19122.10072
-
Size
450KB
-
MD5
0c7194673ca5c213b88c8696d285d205
-
SHA1
d4575c2ea9fc7bc24ca086f403d132b70167cc49
-
SHA256
b1313b8c8d249728b5fe9756332a98c1415468df5f7001f2c1e4c26826edb83e
-
SHA512
a0732717dab0521c73fd6668053311cc96d82176f71b82cbcf91bd484c9cf7803fdde0a42960af338f8aa6b5be505dff71a94c18283c7838b2c0e7cd36821f1c
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Formbook payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Suspicious use of SetThreadContext
-