General
-
Target
ef5801704c64fb48c3bc3f96ba58f18ed4a320835d0f5d36732b3b5c2a2724ef.zip
-
Size
736KB
-
Sample
230310-m1cvbaef7t
-
MD5
f75c60c6368dae03c6011229475bbaae
-
SHA1
10f8da6e833812836798749020a1b29715a2a561
-
SHA256
7e9633b87bba37c06b08aa648f9d91b6cd562f1473ec4dcc8e7a6d5e355ef3d5
-
SHA512
ba2de235f5776eb574a660dfe1097bf41d3149f3d48087486a0761b3df40c53a71f24c2c6a0726ea313f6fa01661faa83933ad2516c9774519c505f2058c687d
-
SSDEEP
12288:MPbj+Jn3Xtcevf62MLicyjVLNmoEFBwLS121AVyZMa++hI8n5w+H:Cj+vXMPyhLNQ2KgAQZModw+H
Malware Config
Extracted
formbook
4.1
g2fg
snowcrash.website
pointman.us
newheartvalve.care
drandl.com
sandspringsramblers.com
programagubernamental.online
boja.us
mvrsnike.com
mentallyillmotherhood.com
facom.us
programagubernamental.store
izivente.com
roller-v.fr
amazonbioactives.com
metaverseapple.xyz
5gt-mobilevsverizon.com
gtwebsolutions.co
scottdunn.life
usdp.trade
pikmin.run
Targets
-
-
Target
ef5801704c64fb48c3bc3f96ba58f18ed4a320835d0f5d36732b3b5c2a2724ef.exe
-
Size
885KB
-
MD5
9fb2fa6e06d3f2a46d78ddd454b2defd
-
SHA1
dcf1825c32d53f3fba95540e89d721d145e8d683
-
SHA256
ef5801704c64fb48c3bc3f96ba58f18ed4a320835d0f5d36732b3b5c2a2724ef
-
SHA512
71b49b4dd668755e2ec107dcf81483f392c8f49373319ac6bd97ef6e995e076cd5d0b52a19193a4494fbc82a7069e36a5bd1371eef83ef80e36c12bdaee2b708
-
SSDEEP
12288:Ssa/5u62iNZVDvoKzfq92bRQpQwhLMTyqSicZ7HyRW/eRAv4wF8DZI:fa/5u61vK8bRQpKrkVdGRAvg
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Formbook payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Suspicious use of SetThreadContext
-