General
-
Target
SecuriteInfo.com.Win32.PWSX-gen.8337.19865
-
Size
1.0MB
-
Sample
221209-f7x1hacd88
-
MD5
d895b9c76dd01f74ed7ac569214bd908
-
SHA1
c4b0c3e114a9d31d7957f873ee0a87731fd16148
-
SHA256
152d5ef19fdfabb482918d51148804bd5227e44e3eb5007dccc347b0ee8585d2
-
SHA512
1a22d896206d1aa1dd40784ba7f2751687c0b1f148620f76b2484e1c105f831d290803cfe28554890ba1055da1eb7e6390cb684c031711cb5d065f0d63d35347
-
SSDEEP
24576:FSfCp6q+gk0huWQks+28p9NpH6tvqrTlzqepF:FjJc9dks+2O9eVqV
Malware Config
Extracted
formbook
4.1
ci07
lain-co.com
weixingshe2777.live
cwin67.com
cabiss.com
absolutehvh.xyz
mycrystallampshop.com
ovalwriters.com
concarneau.net
ciexol.xyz
adulty.net
techartinternational.com
conleyconfection.com
xn--nadinebyond-hbb.world
elevatezed.net
apdodge.xyz
ql456654.vip
amtqu.com
ymvip484.com
00ssolow.kred
fpvmalaysia.com
Targets
-
-
Target
SecuriteInfo.com.Win32.PWSX-gen.8337.19865
-
Size
1.0MB
-
MD5
d895b9c76dd01f74ed7ac569214bd908
-
SHA1
c4b0c3e114a9d31d7957f873ee0a87731fd16148
-
SHA256
152d5ef19fdfabb482918d51148804bd5227e44e3eb5007dccc347b0ee8585d2
-
SHA512
1a22d896206d1aa1dd40784ba7f2751687c0b1f148620f76b2484e1c105f831d290803cfe28554890ba1055da1eb7e6390cb684c031711cb5d065f0d63d35347
-
SSDEEP
24576:FSfCp6q+gk0huWQks+28p9NpH6tvqrTlzqepF:FjJc9dks+2O9eVqV
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Formbook payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Suspicious use of SetThreadContext
-