General
-
Target
Urgent quote request -pdf-.bin
-
Size
636KB
-
Sample
221128-m4qwcadd8z
-
MD5
b8315ffe6f3194b9b8b8188696524867
-
SHA1
bb037856bb04518f5b1948efffbfbe31646af3ef
-
SHA256
d50b5e68cc51789ccf9d892f92fd82ca4340f3603882c9fa24ea965d9e839a80
-
SHA512
874a181dd92fcc9968f88b9a9e6a0e38473f85c4fd4ea84029bc0ed8e2717a957bc6a244b5222c8a7f8716bb85a774dee04c64f73802f9bfbe8c7b421a3ecb02
-
SSDEEP
12288:8pcJpbKbfuLb58ZGYxiudpN0nC3Lf91I64HyfOWyoc+h2j2AKm+:8ajbKCLb58ZGIRb7f9m8g5
Malware Config
Extracted
formbook
4.1
a24e
flormarine.co.uk
theglazingsquad.uk
konarkpharma.com
maxpropertyfinanceuk.co.uk
jackson-ifc.com
yvonneazevedoimoveis.net
baystella.com
arexbaba.online
trihgd.xyz
filth520571.com
cikpkg.cfd
jakesupport.com
8863365.com
duniaslot777.online
lop3a.com
berkut-clan.ru
lernnavigator.com
elenaisaprincess.co.uk
daimadaquan.xyz
mychirocart.net
Targets
-
-
Target
Urgent quote request -pdf-.bin
-
Size
636KB
-
MD5
b8315ffe6f3194b9b8b8188696524867
-
SHA1
bb037856bb04518f5b1948efffbfbe31646af3ef
-
SHA256
d50b5e68cc51789ccf9d892f92fd82ca4340f3603882c9fa24ea965d9e839a80
-
SHA512
874a181dd92fcc9968f88b9a9e6a0e38473f85c4fd4ea84029bc0ed8e2717a957bc6a244b5222c8a7f8716bb85a774dee04c64f73802f9bfbe8c7b421a3ecb02
-
SSDEEP
12288:8pcJpbKbfuLb58ZGYxiudpN0nC3Lf91I64HyfOWyoc+h2j2AKm+:8ajbKCLb58ZGIRb7f9m8g5
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Formbook payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Suspicious use of SetThreadContext
-