General
-
Target
eb86a131d28521c31b5657a236514082.bin
-
Size
789KB
-
Sample
230313-nk76yscc2y
-
MD5
01687158f9a0cb5d9f8724e0895b921a
-
SHA1
292f0a60bffbae3c603e878991b31d62eba989ab
-
SHA256
e973cd0481e2c29276dec6386bba6184c62d10553054d9d5808d53fa885f2d1e
-
SHA512
066e6a0cd432c52a27173d076a6a83ee977256ee474f79bbbc9b1fe137787c5a6bebe149486a60be325755787e56d511bf10029c9505dfc160d18cf8bd062770
-
SSDEEP
24576:xutY8XMooWLPdIb2NGXGSZIeWzlzVlORyb:xr8NoAdirG6wVlNb
Malware Config
Extracted
formbook
4.1
g2fg
snowcrash.website
pointman.us
newheartvalve.care
drandl.com
sandspringsramblers.com
programagubernamental.online
boja.us
mvrsnike.com
mentallyillmotherhood.com
facom.us
programagubernamental.store
izivente.com
roller-v.fr
amazonbioactives.com
metaverseapple.xyz
5gt-mobilevsverizon.com
gtwebsolutions.co
scottdunn.life
usdp.trade
pikmin.run
Targets
-
-
Target
adb24e3f246fd2e4d38866e9273f7f511af700a1601399bc695b01c5ccdbd43c.exe
-
Size
1.1MB
-
MD5
eb86a131d28521c31b5657a236514082
-
SHA1
4aa2ae36980b36b3172a9ea4a2a40e6c3eadc24d
-
SHA256
adb24e3f246fd2e4d38866e9273f7f511af700a1601399bc695b01c5ccdbd43c
-
SHA512
a8935310baef53269253cf37cbeb72c0e8068d7bc875f27d6a9985b2415fb4c26aef68a30ac406b6f6a7c7f602e373be773733646dd08d343fdb0e73dd3c455a
-
SSDEEP
24576:fuOZ6wGkB+e9uf8mSBO4KcDzdgVlRPRHIwayLOMTXfBZiiCaH:6CORcDzehRoiOMTX6iC
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Formbook payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Suspicious use of SetThreadContext
-