General
-
Target
0264ff8e36f69f5a78e417dfe38b48e68c99383b
-
Size
690KB
-
Sample
230201-qj2nwseg96
-
MD5
8ba02b03bb01ec961fdb0b1a5dbd49f1
-
SHA1
0264ff8e36f69f5a78e417dfe38b48e68c99383b
-
SHA256
67cc4306421a289d79bfd855c3da5e7ccbfe55e8eef44fc6c48aea748848ea5b
-
SHA512
09721d0acabd344fb0313cbb3ca2a2f5a76fe7b6ae4c308f4666dea8cbc192984562183f81e8cedbf7da8468db37516bec5d3085579ce11fab73e73d376be0cd
-
SSDEEP
12288:LZuOwJq+5HcYVvQ7A+gYAEBqDGY+UND4IjMxS02Weh3ih9H1A:8Ocllc9AXYRCND4IjMxS02BYTe
Malware Config
Extracted
formbook
4.1
g2fg
snowcrash.website
pointman.us
newheartvalve.care
drandl.com
sandspringsramblers.com
programagubernamental.online
boja.us
mvrsnike.com
mentallyillmotherhood.com
facom.us
programagubernamental.store
izivente.com
roller-v.fr
amazonbioactives.com
metaverseapple.xyz
5gt-mobilevsverizon.com
gtwebsolutions.co
scottdunn.life
usdp.trade
pikmin.run
Targets
-
-
Target
0264ff8e36f69f5a78e417dfe38b48e68c99383b
-
Size
690KB
-
MD5
8ba02b03bb01ec961fdb0b1a5dbd49f1
-
SHA1
0264ff8e36f69f5a78e417dfe38b48e68c99383b
-
SHA256
67cc4306421a289d79bfd855c3da5e7ccbfe55e8eef44fc6c48aea748848ea5b
-
SHA512
09721d0acabd344fb0313cbb3ca2a2f5a76fe7b6ae4c308f4666dea8cbc192984562183f81e8cedbf7da8468db37516bec5d3085579ce11fab73e73d376be0cd
-
SSDEEP
12288:LZuOwJq+5HcYVvQ7A+gYAEBqDGY+UND4IjMxS02Weh3ih9H1A:8Ocllc9AXYRCND4IjMxS02BYTe
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Formbook payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Suspicious use of SetThreadContext
-