General
-
Target
a45cec5c48aae2040669ece459ae34de87251080934add3da91e9ab72ea2abe7
-
Size
555KB
-
Sample
221130-w5aeesdg66
-
MD5
c57658ef781e0f31e6539263bb87c7fc
-
SHA1
4a8902bdbfe4d490aac56b9962caec5598e5604c
-
SHA256
a45cec5c48aae2040669ece459ae34de87251080934add3da91e9ab72ea2abe7
-
SHA512
637f1ef12dc4e3d86f8d5dec18c1cbe88c08db1a150de090e9f1135643136e0abd73f75b0b1c14c6cd144280b736cb25cbe28be13747ccc01e5420fed4a56922
-
SSDEEP
12288:B3tTTCkyO2KnJVr7tjoH5QPpCuzYGWrrUN8ywGIgyfOZadEVFMWM:B9b1r785e1zW8N8ywLfK7F
Malware Config
Extracted
formbook
4.1
bft
edenicities.com
buntingfordhomeservices.com
nuanceproducoes.com
divasinspire.com
capiturn.com
zbjsn.com
thegioicaytrongnha.com
featherventure.com
onbrandtrading.com
sanguoban.com
doorman.pro
ourhomie.net
iwassickonholiday.com
mrcskin.com
reallycoolmask.com
tkrbeautyinstitut.com
keytomiami.com
sesliduybeni.com
asherwebber.com
starkweatherwindows.net
Targets
-
-
Target
a45cec5c48aae2040669ece459ae34de87251080934add3da91e9ab72ea2abe7
-
Size
555KB
-
MD5
c57658ef781e0f31e6539263bb87c7fc
-
SHA1
4a8902bdbfe4d490aac56b9962caec5598e5604c
-
SHA256
a45cec5c48aae2040669ece459ae34de87251080934add3da91e9ab72ea2abe7
-
SHA512
637f1ef12dc4e3d86f8d5dec18c1cbe88c08db1a150de090e9f1135643136e0abd73f75b0b1c14c6cd144280b736cb25cbe28be13747ccc01e5420fed4a56922
-
SSDEEP
12288:B3tTTCkyO2KnJVr7tjoH5QPpCuzYGWrrUN8ywGIgyfOZadEVFMWM:B9b1r785e1zW8N8ywLfK7F
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Formbook payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Suspicious use of SetThreadContext
-