General
-
Target
ef5801704c64fb48c3bc3f96ba58f18ed4a320835d0f5d36732b3b5c2a2724ef.zip
-
Size
736KB
-
Sample
230310-ng1mpsdc36
-
MD5
f92c60ac5b72746d712e3bcfb316c7d5
-
SHA1
e4d67259746fc8091de7fb660d917574092ef762
-
SHA256
93ceac7bea9eb7c2bfb6e6ed8dca3ff277483eb54c72de2c8e11b2cef8c63a8f
-
SHA512
b571f1eedf365a58ef47d5728baa6b75cd0a5c7b89ce81a3dee0964b0faabe786aa405f14ad0a0fd7811623580824afa6c5a69ff383687292908d28f06a21780
-
SSDEEP
12288:FFQ3qBoXkblRPMMpI6PybMTpw4k6ZJWFeNzkP3rk6kdCk77+AS:n3+kvPM2xPyb0pw43ZJNpGbjkB7C
Malware Config
Extracted
formbook
4.1
g2fg
snowcrash.website
pointman.us
newheartvalve.care
drandl.com
sandspringsramblers.com
programagubernamental.online
boja.us
mvrsnike.com
mentallyillmotherhood.com
facom.us
programagubernamental.store
izivente.com
roller-v.fr
amazonbioactives.com
metaverseapple.xyz
5gt-mobilevsverizon.com
gtwebsolutions.co
scottdunn.life
usdp.trade
pikmin.run
Targets
-
-
Target
ef5801704c64fb48c3bc3f96ba58f18ed4a320835d0f5d36732b3b5c2a2724ef.exe
-
Size
885KB
-
MD5
9fb2fa6e06d3f2a46d78ddd454b2defd
-
SHA1
dcf1825c32d53f3fba95540e89d721d145e8d683
-
SHA256
ef5801704c64fb48c3bc3f96ba58f18ed4a320835d0f5d36732b3b5c2a2724ef
-
SHA512
71b49b4dd668755e2ec107dcf81483f392c8f49373319ac6bd97ef6e995e076cd5d0b52a19193a4494fbc82a7069e36a5bd1371eef83ef80e36c12bdaee2b708
-
SSDEEP
12288:Ssa/5u62iNZVDvoKzfq92bRQpQwhLMTyqSicZ7HyRW/eRAv4wF8DZI:fa/5u61vK8bRQpKrkVdGRAvg
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Formbook payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Suspicious use of SetThreadContext
-