General
-
Target
3096adbb908cc66e435ebd189c5e82f5.exe
-
Size
740KB
-
Sample
230130-qdtfbscb7t
-
MD5
3096adbb908cc66e435ebd189c5e82f5
-
SHA1
711fe1d6e190104f618b23f49ff6b12ab4abb1d7
-
SHA256
fd57c25c7f4a591450adba8e8f2755e6a8ef62e9e28b745eae0a7369dc5ef4aa
-
SHA512
b976008f052933cc4bee2242ecfed985f43c164025fa1e17e91823fedc0546a22ed7f60433528e25e3e13166c440d8ecd546012c1bb249035bfafa37d542ec21
-
SSDEEP
12288:5PYIoO6Y+T7ojp0QBhlvlrzUDAwhMs1PhKoekjCAWeh3ih9HeA:5PnoOJtBXvODd95EdTABYTf
Malware Config
Extracted
formbook
4.1
g2fg
snowcrash.website
pointman.us
newheartvalve.care
drandl.com
sandspringsramblers.com
programagubernamental.online
boja.us
mvrsnike.com
mentallyillmotherhood.com
facom.us
programagubernamental.store
izivente.com
roller-v.fr
amazonbioactives.com
metaverseapple.xyz
5gt-mobilevsverizon.com
gtwebsolutions.co
scottdunn.life
usdp.trade
pikmin.run
Targets
-
-
Target
3096adbb908cc66e435ebd189c5e82f5.exe
-
Size
740KB
-
MD5
3096adbb908cc66e435ebd189c5e82f5
-
SHA1
711fe1d6e190104f618b23f49ff6b12ab4abb1d7
-
SHA256
fd57c25c7f4a591450adba8e8f2755e6a8ef62e9e28b745eae0a7369dc5ef4aa
-
SHA512
b976008f052933cc4bee2242ecfed985f43c164025fa1e17e91823fedc0546a22ed7f60433528e25e3e13166c440d8ecd546012c1bb249035bfafa37d542ec21
-
SSDEEP
12288:5PYIoO6Y+T7ojp0QBhlvlrzUDAwhMs1PhKoekjCAWeh3ih9HeA:5PnoOJtBXvODd95EdTABYTf
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Formbook payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Suspicious use of SetThreadContext
-