General
-
Target
a68aec582225be1bfc5ac588c5fb0374.bin
-
Size
710KB
-
Sample
230226-b1kdlsfb21
-
MD5
41942412c4290040acaada2ffe7ff082
-
SHA1
21753fd166977cc66b0b6ec0af99ff4c6009b2e8
-
SHA256
2f1687b626b025d78e0e71a4bd6f3116fd7805aca7f7189d4951c0fbfdda23c8
-
SHA512
ec6e46deceab1d99e44d7f10d1b908cd2b3cb75e24a29c7e928946532da89268432113550a62c672c222ac09161edbff8ac76273875f65b3831acabf4f869ce0
-
SSDEEP
12288:idtQN7zyUopGqyANvCkA9TxwWzunBXdYalvSz9vSrgIMKHNKpX+MbfeOUF1iAyAn:UWN7zy7xytNhx3MjluqrgIMVpX+OesFS
Malware Config
Extracted
formbook
4.1
g2fg
snowcrash.website
pointman.us
newheartvalve.care
drandl.com
sandspringsramblers.com
programagubernamental.online
boja.us
mvrsnike.com
mentallyillmotherhood.com
facom.us
programagubernamental.store
izivente.com
roller-v.fr
amazonbioactives.com
metaverseapple.xyz
5gt-mobilevsverizon.com
gtwebsolutions.co
scottdunn.life
usdp.trade
pikmin.run
Targets
-
-
Target
dbe3f374ece034f9fcfce5ea34796ca35fb13e1a6d929d708ea74a14357676df.exe
-
Size
860KB
-
MD5
a68aec582225be1bfc5ac588c5fb0374
-
SHA1
f7b914779040bfdbdd3fcb9836923d8b8717f7df
-
SHA256
dbe3f374ece034f9fcfce5ea34796ca35fb13e1a6d929d708ea74a14357676df
-
SHA512
1c3666c5b25c77a0f58e98b96e6ece0ea1c778daab9315451ceb9d824bbf789dea63813a1c3ce057fd44824c43e9a61eaa21f90b1fe540032456ee24a917c0ea
-
SSDEEP
24576:gcKGPyp+vPng6lDagoUFqqYU0JYZh4iCtcu:vhv/NlDXoGX0qZ
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Formbook payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Suspicious use of SetThreadContext
-