General
-
Target
REVISED ORDER FOR DECEMBER.lzh
-
Size
443KB
-
Sample
221130-l4jllaaf55
-
MD5
c8f6dc207e64282e9f114f881fef1779
-
SHA1
dd6a42fee900c1a192b0fbf85c82651d90550f8e
-
SHA256
9c299ded0d032383e9335646319295fe1d1e9c6c0165d784a4d00772de1dbcea
-
SHA512
1c823319cdb5c4183bc8fa4626fbf3d8425b7611cffc6eb316864f47c291542bd5541ec1dfbb6e76389259766f7b218c4d87cf088360c90da5160ad77420b73e
-
SSDEEP
12288:k2MjPiQURz4WGylJYnn5L5J7wBVKVFAxlbnnT7pn:5MjqRPly56BVKYPbnR
Malware Config
Extracted
formbook
4.1
f9r5
teknotimur.com
zuliboo.com
remmingtoncampbell.com
vehicletitleloansphoenix.com
sen-computer.com
98731.biz
shelikesblu.com
canis-totem.com
metaversemedianetwork.com
adsdu.com
vanishmediasystems.com
astewaykebede.com
wszhongxue.com
gacha-animator-free.com
papatyadekorasyon.com
mqc168.top
simplebrilliantsolutions.com
jubileehawkesprairie.com
ridflab.com
conboysfilm.com
Targets
-
-
Target
REVISED ORDER FOR DECEMBER.exe
-
Size
573KB
-
MD5
0e27fab3f710b0b524091aba6ed455c7
-
SHA1
2b6aca7bc31a565f0cb1e00d9daab463b570f269
-
SHA256
40f511e420e73d2cb620d782e9ed31dbd1dabe4103b31e025a4158d39a209a5e
-
SHA512
d795b666ec53c9ed058c8fa77dac06e6e77f9d4871dfea8d59ebe49653b9b0620d292677482a88e81b276893948780db6ecc7b7e67ebb1c2a1995fc16876ba2a
-
SSDEEP
6144:/+qpqSmgUZtFUaJqMJ3iwyoqAnrHxC4AbUkO0dDW8P4SATkU6Uk5dWXwzlf7Tvm:GqgSmdzUZAUndDWE4pkFv5DzA
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Formbook payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Suspicious use of SetThreadContext
-