General
-
Target
c1191a2395a4bcd7c12c63ed628be5c3df1ab0d0b51d46932716fb0c917c0dde
-
Size
955KB
-
Sample
221130-q8rj8aab71
-
MD5
c1b83daeb8757d575a940c65bccb0d1b
-
SHA1
857e57fbce938345d8baea856ce232179627e995
-
SHA256
c1191a2395a4bcd7c12c63ed628be5c3df1ab0d0b51d46932716fb0c917c0dde
-
SHA512
8a8f80c1de2c2fed85091160b1c6c3912b43ed5627d05abb7a8a713a41bf1edfac06e8bd6023925a82b56eafa5340ed4880705588c5e6b405bf70e6cd7b8c3e9
-
SSDEEP
12288:/6FSCKAIMqmB0a08IEvs81TMe1vJrW5/n8T8S/5uEJ52:a1fI00z8IR81Tdx+8oE3J
Malware Config
Extracted
formbook
4.1
mdi
uproarcatalyst.com
cruisessafaris.com
simplethreads.net
ncsetup.com
dthengjia.com
heyfig.com
inventqa.com
mentoriareset.com
a70a.com
ncolesrose.com
culasarsa.com
southdocknj.com
pistrinalove.com
championvanleasing.com
mazda40.com
lujoscenter.com
wgsol.com
iheart2d.com
olympiccarpetcare.com
aiored.com
Targets
-
-
Target
c1191a2395a4bcd7c12c63ed628be5c3df1ab0d0b51d46932716fb0c917c0dde
-
Size
955KB
-
MD5
c1b83daeb8757d575a940c65bccb0d1b
-
SHA1
857e57fbce938345d8baea856ce232179627e995
-
SHA256
c1191a2395a4bcd7c12c63ed628be5c3df1ab0d0b51d46932716fb0c917c0dde
-
SHA512
8a8f80c1de2c2fed85091160b1c6c3912b43ed5627d05abb7a8a713a41bf1edfac06e8bd6023925a82b56eafa5340ed4880705588c5e6b405bf70e6cd7b8c3e9
-
SSDEEP
12288:/6FSCKAIMqmB0a08IEvs81TMe1vJrW5/n8T8S/5uEJ52:a1fI00z8IR81Tdx+8oE3J
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Formbook payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Suspicious use of SetThreadContext
-