General
-
Target
5B284EA7D120DD963C6DD264EC57782D8593867B9FDC2B849D0730DEFDC22DEB
-
Size
1.2MB
-
Sample
221208-yfezqabb98
-
MD5
df4ae3c329a4657f086d3fbdba04fdda
-
SHA1
51b567ebb0befcb1f517c5b7d8c16cc0bbc57746
-
SHA256
5b284ea7d120dd963c6dd264ec57782d8593867b9fdc2b849d0730defdc22deb
-
SHA512
d602d7085a0d474144c4b9fb2e97f51b9efb5b49567950f71161ba15be055d45a81514f0d7db34345c27ba81adcd3e68ab6f84268f74ed0dbb2c47a501aa712a
-
SSDEEP
6144:k+qpqSmgUZtFUaJqMJ3iwyoqAnrHxC4AbUkO0dDW8P4SATkU6Uk5dWXwzlf7Tvm:jqgSmdzUZAUndDWE4pkFv5DzA
Malware Config
Extracted
formbook
4.1
f9r5
teknotimur.com
zuliboo.com
remmingtoncampbell.com
vehicletitleloansphoenix.com
sen-computer.com
98731.biz
shelikesblu.com
canis-totem.com
metaversemedianetwork.com
adsdu.com
vanishmediasystems.com
astewaykebede.com
wszhongxue.com
gacha-animator-free.com
papatyadekorasyon.com
mqc168.top
simplebrilliantsolutions.com
jubileehawkesprairie.com
ridflab.com
conboysfilm.com
Targets
-
-
Target
REVISED_.EXE
-
Size
573KB
-
MD5
0e27fab3f710b0b524091aba6ed455c7
-
SHA1
2b6aca7bc31a565f0cb1e00d9daab463b570f269
-
SHA256
40f511e420e73d2cb620d782e9ed31dbd1dabe4103b31e025a4158d39a209a5e
-
SHA512
d795b666ec53c9ed058c8fa77dac06e6e77f9d4871dfea8d59ebe49653b9b0620d292677482a88e81b276893948780db6ecc7b7e67ebb1c2a1995fc16876ba2a
-
SSDEEP
6144:/+qpqSmgUZtFUaJqMJ3iwyoqAnrHxC4AbUkO0dDW8P4SATkU6Uk5dWXwzlf7Tvm:GqgSmdzUZAUndDWE4pkFv5DzA
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Formbook payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Suspicious use of SetThreadContext
-