General
-
Target
a68aec582225be1bfc5ac588c5fb0374.exe
-
Size
860KB
-
Sample
230224-qz9dnsdd9w
-
MD5
a68aec582225be1bfc5ac588c5fb0374
-
SHA1
f7b914779040bfdbdd3fcb9836923d8b8717f7df
-
SHA256
dbe3f374ece034f9fcfce5ea34796ca35fb13e1a6d929d708ea74a14357676df
-
SHA512
1c3666c5b25c77a0f58e98b96e6ece0ea1c778daab9315451ceb9d824bbf789dea63813a1c3ce057fd44824c43e9a61eaa21f90b1fe540032456ee24a917c0ea
-
SSDEEP
24576:gcKGPyp+vPng6lDagoUFqqYU0JYZh4iCtcu:vhv/NlDXoGX0qZ
Malware Config
Extracted
formbook
4.1
g2fg
snowcrash.website
pointman.us
newheartvalve.care
drandl.com
sandspringsramblers.com
programagubernamental.online
boja.us
mvrsnike.com
mentallyillmotherhood.com
facom.us
programagubernamental.store
izivente.com
roller-v.fr
amazonbioactives.com
metaverseapple.xyz
5gt-mobilevsverizon.com
gtwebsolutions.co
scottdunn.life
usdp.trade
pikmin.run
Targets
-
-
Target
a68aec582225be1bfc5ac588c5fb0374.exe
-
Size
860KB
-
MD5
a68aec582225be1bfc5ac588c5fb0374
-
SHA1
f7b914779040bfdbdd3fcb9836923d8b8717f7df
-
SHA256
dbe3f374ece034f9fcfce5ea34796ca35fb13e1a6d929d708ea74a14357676df
-
SHA512
1c3666c5b25c77a0f58e98b96e6ece0ea1c778daab9315451ceb9d824bbf789dea63813a1c3ce057fd44824c43e9a61eaa21f90b1fe540032456ee24a917c0ea
-
SSDEEP
24576:gcKGPyp+vPng6lDagoUFqqYU0JYZh4iCtcu:vhv/NlDXoGX0qZ
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Formbook payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Suspicious use of SetThreadContext
-