General
-
Target
ba79f26ac9099e86e4ee3b045c484909.exe
-
Size
1.0MB
-
Sample
230223-bk3v1sec84
-
MD5
ba79f26ac9099e86e4ee3b045c484909
-
SHA1
3b991533e9a9fb044015e13265dc61028fd19d5f
-
SHA256
0cf03f46e827627fc7cf3683f21e1da0f18d5a6e22e46f7aa4867aef4012b8e4
-
SHA512
614f898159e4b29f89c142400a2dcffc8e044e0094055f9d36a9569d431b4a2306cbe69742c5b99dce19494f175b806ba03dab39cea55031d073a75dcb516caa
-
SSDEEP
24576:B4w4yZ1sQDNaCz9HFB6VBf2q+3y6BJQEcXNrYE:GUPaiuVBfm7Q1eE
Malware Config
Extracted
formbook
4.1
g2fg
snowcrash.website
pointman.us
newheartvalve.care
drandl.com
sandspringsramblers.com
programagubernamental.online
boja.us
mvrsnike.com
mentallyillmotherhood.com
facom.us
programagubernamental.store
izivente.com
roller-v.fr
amazonbioactives.com
metaverseapple.xyz
5gt-mobilevsverizon.com
gtwebsolutions.co
scottdunn.life
usdp.trade
pikmin.run
Targets
-
-
Target
ba79f26ac9099e86e4ee3b045c484909.exe
-
Size
1.0MB
-
MD5
ba79f26ac9099e86e4ee3b045c484909
-
SHA1
3b991533e9a9fb044015e13265dc61028fd19d5f
-
SHA256
0cf03f46e827627fc7cf3683f21e1da0f18d5a6e22e46f7aa4867aef4012b8e4
-
SHA512
614f898159e4b29f89c142400a2dcffc8e044e0094055f9d36a9569d431b4a2306cbe69742c5b99dce19494f175b806ba03dab39cea55031d073a75dcb516caa
-
SSDEEP
24576:B4w4yZ1sQDNaCz9HFB6VBf2q+3y6BJQEcXNrYE:GUPaiuVBfm7Q1eE
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Formbook payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Suspicious use of SetThreadContext
-