General
-
Target
267cdbd24ba0c232c80967c7c39f454db0e59b6943836750a5cfbaf2540768d8
-
Size
381KB
-
Sample
221130-vzbvmadc9v
-
MD5
bc0d9c5250c435e2b08aad396db5fbea
-
SHA1
8ef94d5400b6d10fa683ca6bad7efd19ef2282c3
-
SHA256
267cdbd24ba0c232c80967c7c39f454db0e59b6943836750a5cfbaf2540768d8
-
SHA512
70f75fa30063fdd3b0452e4d0b2936d27de2bfa3c7c5430bb96e532229211ffab167dcf32cfb552463c075b12f01427132c207f530026df710cd4e72174c6269
-
SSDEEP
6144:bDsrpmOp5fjFopppppppp4a5pppppppppppppppppppppppppppppppppppppppQ:bDsdRBGpppppppp/ppppppppppppppp
Malware Config
Extracted
formbook
3.8
mi
deliris.net
tqcsi-yaran.com
sgrejg.info
vertical-boiler.com
10-56milanstreetmentone.com
electricoslaheroica.com
bombergersarchive.com
177vno.info
hydbad.com
amazonsignage.com
marcelkulhanek.com
purebeautyorganic.com
icerinkcoffee.com
hengshuiyafeng.com
improvereligion.com
hydroponics-aeroponics.com
botmatridee.com
summerfieldalignment.com
xeroaccountantmelbourne.net
babelgrim.net
Targets
-
-
Target
267cdbd24ba0c232c80967c7c39f454db0e59b6943836750a5cfbaf2540768d8
-
Size
381KB
-
MD5
bc0d9c5250c435e2b08aad396db5fbea
-
SHA1
8ef94d5400b6d10fa683ca6bad7efd19ef2282c3
-
SHA256
267cdbd24ba0c232c80967c7c39f454db0e59b6943836750a5cfbaf2540768d8
-
SHA512
70f75fa30063fdd3b0452e4d0b2936d27de2bfa3c7c5430bb96e532229211ffab167dcf32cfb552463c075b12f01427132c207f530026df710cd4e72174c6269
-
SSDEEP
6144:bDsrpmOp5fjFopppppppp4a5pppppppppppppppppppppppppppppppppppppppQ:bDsdRBGpppppppp/ppppppppppppppp
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Formbook payload
-
Executes dropped EXE
-
Drops startup file
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Uses the VBS compiler for execution
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-