General
-
Target
602c739be9c3c942bc0684d824d5aa52ff7bca30abb2c8261dc0106c2571b7a2
-
Size
1.4MB
-
Sample
220731-g4r6hsddcl
-
MD5
77f0f467f4dd24a29e61427720c0ca1e
-
SHA1
7877047c7ac9bf91a13a7c5d6eae70460f3d3d5b
-
SHA256
602c739be9c3c942bc0684d824d5aa52ff7bca30abb2c8261dc0106c2571b7a2
-
SHA512
078e4904880602085ac61e016c5bc3a8fd4081b4b46f8d15fa594211b9224324e21765e58706c86b2bfbc21cda2d85220fd8b53ebc38bb4f46f5545ee8d6e5d8
Malware Config
Extracted
netwire
185.125.205.84:6394
-
activex_autorun
true
-
activex_key
{A21KRE7N-163G-58R1-55FA-N5EO6T322124}
-
copy_executable
false
-
delete_original
false
-
host_id
HostId-%Rand%
-
keylogger_dir
%AppData%\Logs\
-
lock_executable
false
-
offline_keylogger
true
-
password
Password
-
registry_autorun
false
-
use_mutex
false
Extracted
formbook
3.9
ch
sfbayfoodie.com
tridonics.com
got-stuff.com
vvk2.com
legacytrailsurgery.com
lintec-europeuk.com
pqbs4all.online
tensionon.com
5pkmko5-ddz.com
anuvallie.com
chornatastudio.com
hydroponic.today
soluinformatic.com
senero.info
pdblm.com
zumarecordings.com
vfun.ltd
hanyiwaimai.com
sourcingdog.com
hntgwl.com
Targets
-
-
Target
602c739be9c3c942bc0684d824d5aa52ff7bca30abb2c8261dc0106c2571b7a2
-
Size
1.4MB
-
MD5
77f0f467f4dd24a29e61427720c0ca1e
-
SHA1
7877047c7ac9bf91a13a7c5d6eae70460f3d3d5b
-
SHA256
602c739be9c3c942bc0684d824d5aa52ff7bca30abb2c8261dc0106c2571b7a2
-
SHA512
078e4904880602085ac61e016c5bc3a8fd4081b4b46f8d15fa594211b9224324e21765e58706c86b2bfbc21cda2d85220fd8b53ebc38bb4f46f5545ee8d6e5d8
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
NetWire RAT payload
-
Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
-
Formbook payload
-
Adds policy Run key to start application
-
Executes dropped EXE
-
Modifies Installed Components in the registry
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of SetThreadContext
-