General
-
Target
4a7aab8f4285b00870594319a36a7426.bin
-
Size
1022KB
-
Sample
230302-bl2z4sae5s
-
MD5
2f0bf7ec0072facc47e22dd6e6819875
-
SHA1
91db39171d30e8cae331cd46282c7cadf98d1676
-
SHA256
e718ac7980309c5b560fd82e94bd3c0c34024d71df077260d55ca35e4c045413
-
SHA512
defcd8b86f94a0370dce70134154da1b26f5d56403989415f84565ca66346b7f28caf33e78db60aa0f7dd7a479dc2fb400d66c797f8de8302245ee87aee8e4a6
-
SSDEEP
24576:cTEhqWc50Dku4xd5Wzv07q9UVwUFA+u9SZTzJ:cTEq0Cd5Wzv0miDTu4hzJ
Malware Config
Extracted
formbook
4.1
g2fg
snowcrash.website
pointman.us
newheartvalve.care
drandl.com
sandspringsramblers.com
programagubernamental.online
boja.us
mvrsnike.com
mentallyillmotherhood.com
facom.us
programagubernamental.store
izivente.com
roller-v.fr
amazonbioactives.com
metaverseapple.xyz
5gt-mobilevsverizon.com
gtwebsolutions.co
scottdunn.life
usdp.trade
pikmin.run
Targets
-
-
Target
ee62bac96fdf6c8fa0bf931f53a9858584cbe77e814f3e0a08a9a0fcb1fe55f3.exe
-
Size
1.3MB
-
MD5
4a7aab8f4285b00870594319a36a7426
-
SHA1
a4331309a71b9f87eab79e9596d62af931d3b026
-
SHA256
ee62bac96fdf6c8fa0bf931f53a9858584cbe77e814f3e0a08a9a0fcb1fe55f3
-
SHA512
46c643a71ec2a5a73a81568a44af373104bbaf8fd44b4e13b2f53e4935444f3d0d633c2b23392cf7da00fbde3d7b025b5e93df6f9f5fd9a71574ff78d0c0c796
-
SSDEEP
24576:qlpUJKD7SzYPJ+Z2LGNvd9pFwPRwb+35fDiyBHbuGxbCA6/+otqJ7:ZK3SzYxC2LGBYZwypLicSGha+35
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Formbook payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Suspicious use of SetThreadContext
-