General
-
Target
e9976decc37ac759d56f0fdbc495b804.exe
-
Size
1.1MB
-
Sample
220809-k8zmyahhd7
-
MD5
e9976decc37ac759d56f0fdbc495b804
-
SHA1
66922b70183f5fea0b9858df614337b006fa0ef0
-
SHA256
16346c87bff4969bbcd6fce669ca1cd8d7a54b069a8ce292aebb107e4607c8a9
-
SHA512
62aa267c2ce84bfec037941b67d280cecf2f7e05e4bfc4fa7e535c71657132399451e940e85190f285dbd1d63ec3f0f26f143f4771c9c2ee4409ae7bb36ad732
Malware Config
Extracted
formbook
4.1
t3c9
shadeshmarriagemedia.com
e-russ.com
sofiashome.com
theworriedwell.com
americantechfront.com
seasonssparkling.com
maximuscanada.net
tifin-private-markets.com
amecc2.net
xuexi22.icu
injectiontek.com
enrrocastoneimports.com
marvelouslightcandleco.com
eaamedia.com
pmediaerp.com
tikivips111.com
chesterfieldcleaningcare.com
thecrowdedtablemusic.com
duncanvillepanthers.com
floriculturajoinville.xyz
Targets
-
-
Target
e9976decc37ac759d56f0fdbc495b804.exe
-
Size
1.1MB
-
MD5
e9976decc37ac759d56f0fdbc495b804
-
SHA1
66922b70183f5fea0b9858df614337b006fa0ef0
-
SHA256
16346c87bff4969bbcd6fce669ca1cd8d7a54b069a8ce292aebb107e4607c8a9
-
SHA512
62aa267c2ce84bfec037941b67d280cecf2f7e05e4bfc4fa7e535c71657132399451e940e85190f285dbd1d63ec3f0f26f143f4771c9c2ee4409ae7bb36ad732
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Formbook payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-