General
-
Target
67725018b2c8d91b182dccbff9fbe336
-
Size
549KB
-
Sample
221128-3q1rdsfh6y
-
MD5
67725018b2c8d91b182dccbff9fbe336
-
SHA1
a2c2199b03b55288c7f848ac49ab6fe058a5a7c8
-
SHA256
d936dbd1677939645b8945767ce9525ad92f068e0d81c9316e4c83fe916811cc
-
SHA512
df33c45d52b65475878d64bafd5c5ec5abe0097293fa97cf160db133203a26890d6dd40b9858cab19b009e0a17dd967011e90c075fc4e8e28ec42226223b8353
-
SSDEEP
12288:mysDa+9h79fxrp1JKnJ2dshdzRQseJOzsjQvJ:3s2YprTongyPdV+OQ
Malware Config
Extracted
formbook
4.1
g2fg
snowcrash.website
pointman.us
newheartvalve.care
drandl.com
sandspringsramblers.com
programagubernamental.online
boja.us
mvrsnike.com
mentallyillmotherhood.com
facom.us
programagubernamental.store
izivente.com
roller-v.fr
amazonbioactives.com
metaverseapple.xyz
5gt-mobilevsverizon.com
gtwebsolutions.co
scottdunn.life
usdp.trade
pikmin.run
Targets
-
-
Target
67725018b2c8d91b182dccbff9fbe336
-
Size
549KB
-
MD5
67725018b2c8d91b182dccbff9fbe336
-
SHA1
a2c2199b03b55288c7f848ac49ab6fe058a5a7c8
-
SHA256
d936dbd1677939645b8945767ce9525ad92f068e0d81c9316e4c83fe916811cc
-
SHA512
df33c45d52b65475878d64bafd5c5ec5abe0097293fa97cf160db133203a26890d6dd40b9858cab19b009e0a17dd967011e90c075fc4e8e28ec42226223b8353
-
SSDEEP
12288:mysDa+9h79fxrp1JKnJ2dshdzRQseJOzsjQvJ:3s2YprTongyPdV+OQ
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Formbook payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Suspicious use of SetThreadContext
-