General
-
Target
d98fa49e2118a1aa073d0dc09ef61716.exe
-
Size
1.0MB
-
Sample
221122-s4sylaha57
-
MD5
d98fa49e2118a1aa073d0dc09ef61716
-
SHA1
d61f0aa15ed733d8162ef45c8e7613caa1747615
-
SHA256
e4d9569944d2384d12aefa1b70f9c9799bc5f31e3031078b022bc144424dbe29
-
SHA512
7994713df8a7b8dcec361e01e42a6a04e5622fcc696b3bdb2b59c5fec6d0a8770e51f18f18a59ba3eea5440310b63eb89d6a7e06e284e8bceaae878de59cbe2e
-
SSDEEP
12288:oYe7Vk2iNUsZ1DX/VDJSRodO8Kdkkdj+N0nm9Ad9EZg5tbG016T5F8g6S27hUNyJ:F1u1qdO8Kak8N9OAg5doj8gW7h9pmU
Malware Config
Extracted
formbook
4.1
g2fg
snowcrash.website
pointman.us
newheartvalve.care
drandl.com
sandspringsramblers.com
programagubernamental.online
boja.us
mvrsnike.com
mentallyillmotherhood.com
facom.us
programagubernamental.store
izivente.com
roller-v.fr
amazonbioactives.com
metaverseapple.xyz
5gt-mobilevsverizon.com
gtwebsolutions.co
scottdunn.life
usdp.trade
pikmin.run
Targets
-
-
Target
d98fa49e2118a1aa073d0dc09ef61716.exe
-
Size
1.0MB
-
MD5
d98fa49e2118a1aa073d0dc09ef61716
-
SHA1
d61f0aa15ed733d8162ef45c8e7613caa1747615
-
SHA256
e4d9569944d2384d12aefa1b70f9c9799bc5f31e3031078b022bc144424dbe29
-
SHA512
7994713df8a7b8dcec361e01e42a6a04e5622fcc696b3bdb2b59c5fec6d0a8770e51f18f18a59ba3eea5440310b63eb89d6a7e06e284e8bceaae878de59cbe2e
-
SSDEEP
12288:oYe7Vk2iNUsZ1DX/VDJSRodO8Kdkkdj+N0nm9Ad9EZg5tbG016T5F8g6S27hUNyJ:F1u1qdO8Kak8N9OAg5doj8gW7h9pmU
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Formbook payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Suspicious use of SetThreadContext
-