General
-
Target
bb4e86fa92499e118e502b2e0bc81d0389048c678e2ce9b2ffef5c81f489eb05
-
Size
913KB
-
Sample
230213-gfgpwabb88
-
MD5
debe170f50f06aebab1d2f73f38c7e1c
-
SHA1
4cb00e909a171eaf77e95ec8beace8940d9256bd
-
SHA256
bb4e86fa92499e118e502b2e0bc81d0389048c678e2ce9b2ffef5c81f489eb05
-
SHA512
f56cad6bb311fde24294f39450e0fe75a70c9cffbd6ac525b554e11006401b51b18fef1c686f78da32dc29207b5e315b97fdb1c03a7b2f4b2b19a4164438f390
-
SSDEEP
24576:sb8FUqa9ywhtVZWKqINBKXJCPXgVOKPPPD:/5a9B/bqIi8/gAiPD
Malware Config
Extracted
formbook
4.1
g2fg
snowcrash.website
pointman.us
newheartvalve.care
drandl.com
sandspringsramblers.com
programagubernamental.online
boja.us
mvrsnike.com
mentallyillmotherhood.com
facom.us
programagubernamental.store
izivente.com
roller-v.fr
amazonbioactives.com
metaverseapple.xyz
5gt-mobilevsverizon.com
gtwebsolutions.co
scottdunn.life
usdp.trade
pikmin.run
Targets
-
-
Target
bb4e86fa92499e118e502b2e0bc81d0389048c678e2ce9b2ffef5c81f489eb05
-
Size
913KB
-
MD5
debe170f50f06aebab1d2f73f38c7e1c
-
SHA1
4cb00e909a171eaf77e95ec8beace8940d9256bd
-
SHA256
bb4e86fa92499e118e502b2e0bc81d0389048c678e2ce9b2ffef5c81f489eb05
-
SHA512
f56cad6bb311fde24294f39450e0fe75a70c9cffbd6ac525b554e11006401b51b18fef1c686f78da32dc29207b5e315b97fdb1c03a7b2f4b2b19a4164438f390
-
SSDEEP
24576:sb8FUqa9ywhtVZWKqINBKXJCPXgVOKPPPD:/5a9B/bqIi8/gAiPD
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Formbook payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Suspicious use of SetThreadContext
-