General
-
Target
de206b305280991ecd6694cc524d7b93e72c63ddedd21bf25e5f8e48ca68875d
-
Size
874KB
-
Sample
221013-btp1hsacek
-
MD5
ad464cd6fab86513f30909f0bc27824f
-
SHA1
36f76d860272db72f0ce914ae0f63471000040af
-
SHA256
de206b305280991ecd6694cc524d7b93e72c63ddedd21bf25e5f8e48ca68875d
-
SHA512
33978e6b73f341e9cfd4b2c1f38b90b21be38c655044e721839ea415435435d751966a2c2ced28240447e43424afc67cc2a28e44df42a55cfa451b28853f689f
-
SSDEEP
24576:pkS1iKn5q5M4y7BAgAiIekzFgYgl4O2XeLoPx:pkNl5aivAl4fOLoJ
Malware Config
Extracted
formbook
4.1
t3c9
shadeshmarriagemedia.com
e-russ.com
sofiashome.com
theworriedwell.com
americantechfront.com
seasonssparkling.com
maximuscanada.net
tifin-private-markets.com
amecc2.net
xuexi22.icu
injectiontek.com
enrrocastoneimports.com
marvelouslightcandleco.com
eaamedia.com
pmediaerp.com
tikivips111.com
chesterfieldcleaningcare.com
thecrowdedtablemusic.com
duncanvillepanthers.com
floriculturajoinville.xyz
Targets
-
-
Target
de206b305280991ecd6694cc524d7b93e72c63ddedd21bf25e5f8e48ca68875d
-
Size
874KB
-
MD5
ad464cd6fab86513f30909f0bc27824f
-
SHA1
36f76d860272db72f0ce914ae0f63471000040af
-
SHA256
de206b305280991ecd6694cc524d7b93e72c63ddedd21bf25e5f8e48ca68875d
-
SHA512
33978e6b73f341e9cfd4b2c1f38b90b21be38c655044e721839ea415435435d751966a2c2ced28240447e43424afc67cc2a28e44df42a55cfa451b28853f689f
-
SSDEEP
24576:pkS1iKn5q5M4y7BAgAiIekzFgYgl4O2XeLoPx:pkNl5aivAl4fOLoJ
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Formbook payload
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-