General
-
Target
SecuriteInfo.com.Win32.PWSX-gen.16696.22525.exe
-
Size
830KB
-
Sample
221206-e3netscd7w
-
MD5
117d8fe530f41f5eb068b27480377234
-
SHA1
c61eb8e55dbaa0aaacddec463b39d6ef00cc3566
-
SHA256
0ce95ed2a26eb4e5f38cd27cbcac2065b3e6a71a26cdc24f56946dd0428f88be
-
SHA512
41a273e191f66b22cc3b86115b867df8fdf2721c5d5ffa3c4ec73f1bf91c5eb575ffecbf0ddd6fa5de817b4d63eb7f788a49e284780e04f14b8788b02486625f
-
SSDEEP
12288:Bc6sfZ344iymiLkOPQJzCcAipT+oXuKDz7AWPz5jjmahgKZ/nXt7virmWhlGLaQ1:S6sfe4iymiNPm2cepKDz7vPl
Malware Config
Extracted
formbook
4.1
f9r5
teknotimur.com
zuliboo.com
remmingtoncampbell.com
vehicletitleloansphoenix.com
sen-computer.com
98731.biz
shelikesblu.com
canis-totem.com
metaversemedianetwork.com
adsdu.com
vanishmediasystems.com
astewaykebede.com
wszhongxue.com
gacha-animator-free.com
papatyadekorasyon.com
mqc168.top
simplebrilliantsolutions.com
jubileehawkesprairie.com
ridflab.com
conboysfilm.com
Targets
-
-
Target
SecuriteInfo.com.Win32.PWSX-gen.16696.22525.exe
-
Size
830KB
-
MD5
117d8fe530f41f5eb068b27480377234
-
SHA1
c61eb8e55dbaa0aaacddec463b39d6ef00cc3566
-
SHA256
0ce95ed2a26eb4e5f38cd27cbcac2065b3e6a71a26cdc24f56946dd0428f88be
-
SHA512
41a273e191f66b22cc3b86115b867df8fdf2721c5d5ffa3c4ec73f1bf91c5eb575ffecbf0ddd6fa5de817b4d63eb7f788a49e284780e04f14b8788b02486625f
-
SSDEEP
12288:Bc6sfZ344iymiLkOPQJzCcAipT+oXuKDz7AWPz5jjmahgKZ/nXt7virmWhlGLaQ1:S6sfe4iymiNPm2cepKDz7vPl
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Formbook payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Suspicious use of SetThreadContext
-