General
-
Target
dffde60dc2cab7ca3e0f5c7b19c4bc654dc6941dbf3a7e5ef9b312b7c4c1c656
-
Size
289KB
-
Sample
220803-dlb5ssfefj
-
MD5
6ee33079ee7b4cf222209c1b8b59343f
-
SHA1
a5d080a864977564aa336acb35fbd27b394d622b
-
SHA256
dffde60dc2cab7ca3e0f5c7b19c4bc654dc6941dbf3a7e5ef9b312b7c4c1c656
-
SHA512
66dfb31df07f822c7daba3c66cc06f900d8b2cd83d6e0224cb079836ca52e17d446788ffae8daa56a369e43f54fd9e3fc7017f9e8a8930293b7640752c839abd
Malware Config
Extracted
formbook
4.1
s4s9
qianyuandianshang.com
bernardklein.com
slhomeservices.com
findasaas.com
janellelancaster.xyz
umkpro.site
nr6949.online
mersquare.club
lanariproperties.com
3rdeyefocused.com
giftexpress8260.xyz
hilleleven.xyz
beajod.com
kosazs.online
ishare.team
mb314.com
xjjinxingda.com
ayekooprojectamazing.com
ballsybanter.com
todayshoppingbd.com
Targets
-
-
Target
dffde60dc2cab7ca3e0f5c7b19c4bc654dc6941dbf3a7e5ef9b312b7c4c1c656
-
Size
289KB
-
MD5
6ee33079ee7b4cf222209c1b8b59343f
-
SHA1
a5d080a864977564aa336acb35fbd27b394d622b
-
SHA256
dffde60dc2cab7ca3e0f5c7b19c4bc654dc6941dbf3a7e5ef9b312b7c4c1c656
-
SHA512
66dfb31df07f822c7daba3c66cc06f900d8b2cd83d6e0224cb079836ca52e17d446788ffae8daa56a369e43f54fd9e3fc7017f9e8a8930293b7640752c839abd
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Formbook payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Suspicious use of SetThreadContext
-