General
-
Target
9b4fbeab783034812b8cf0380168f23a74379f34bdb65588b05eb297e47abcec
-
Size
885KB
-
Sample
220920-qkdy8adad8
-
MD5
a6e669df1da333734848090ecfe1adca
-
SHA1
2d7f592a068b211ebeafa7eb40e673fd2b2502bd
-
SHA256
9b4fbeab783034812b8cf0380168f23a74379f34bdb65588b05eb297e47abcec
-
SHA512
2a18da346baa8f68734e3cedfad167801883e384d896f115e462335d9f42c33bcbac682a8d0f0f37734720887ca1855e3837686e3dbdf6c020cdb1648ae266f9
-
SSDEEP
12288:+dvSgikKHSXrFGZ/1nPaPih+gTiwCAI5T7grmN7vwui44YXas4E+Jymf7fv:+dkDSXrAzaNaizeaNydYXas4E+Dv
Malware Config
Extracted
formbook
4.1
t3c9
shadeshmarriagemedia.com
e-russ.com
sofiashome.com
theworriedwell.com
americantechfront.com
seasonssparkling.com
maximuscanada.net
tifin-private-markets.com
amecc2.net
xuexi22.icu
injectiontek.com
enrrocastoneimports.com
marvelouslightcandleco.com
eaamedia.com
pmediaerp.com
tikivips111.com
chesterfieldcleaningcare.com
thecrowdedtablemusic.com
duncanvillepanthers.com
floriculturajoinville.xyz
Targets
-
-
Target
9b4fbeab783034812b8cf0380168f23a74379f34bdb65588b05eb297e47abcec
-
Size
885KB
-
MD5
a6e669df1da333734848090ecfe1adca
-
SHA1
2d7f592a068b211ebeafa7eb40e673fd2b2502bd
-
SHA256
9b4fbeab783034812b8cf0380168f23a74379f34bdb65588b05eb297e47abcec
-
SHA512
2a18da346baa8f68734e3cedfad167801883e384d896f115e462335d9f42c33bcbac682a8d0f0f37734720887ca1855e3837686e3dbdf6c020cdb1648ae266f9
-
SSDEEP
12288:+dvSgikKHSXrFGZ/1nPaPih+gTiwCAI5T7grmN7vwui44YXas4E+Jymf7fv:+dkDSXrAzaNaizeaNydYXas4E+Dv
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Formbook payload
-
ModiLoader Second Stage
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-