General
-
Target
Elektronik Odeme Bilgileri Swift mesaji makbuzu 20230322_8755450T.exe
-
Size
800KB
-
Sample
230322-xn8fkaag56
-
MD5
f012f4e4f4bc3d5989ec7e74574567d9
-
SHA1
c130806d7f968656825c6357a01b9809bd586637
-
SHA256
fcc1683097894f7f965dcbb2abcd28e98f4ab15e925ceaa75ae35bcf0c88f372
-
SHA512
67496a7eac21bcb95621734c38ac906f657fce34598b7d7e31524a06d6633059fdedb9e29c07d0c81298a6b0b86fdd7219a0b862111984eba9e992b06fac3d45
-
SSDEEP
24576:FZHsZLj9epRclsNQ5Vzd1LWOqNt/w4Qz2Dw:FhsZLBepRclLHLOxw4W20
Malware Config
Extracted
formbook
4.1
jr22
941zhe.com
lunarportal.space
xn--osmaniyeiek-t9ab.online
trejoscar.com
nrnursery.com
quizcannot.cfd
seedstockersthailand.com
watsonwindow.com
wjfholdings.com
weziclondon.com
naruot.xyz
yeji.plus
classicmenstore.com
oharatravel.com
therapyplankits.com
keviegreshonpt.com
qdlyner.com
seithupaarungal.com
casinorates.online
8ug4as.icu
Extracted
formbook
jr22
941zhe.com
lunarportal.space
xn--osmaniyeiek-t9ab.online
trejoscar.com
nrnursery.com
quizcannot.cfd
seedstockersthailand.com
watsonwindow.com
wjfholdings.com
weziclondon.com
naruot.xyz
yeji.plus
classicmenstore.com
oharatravel.com
therapyplankits.com
keviegreshonpt.com
qdlyner.com
seithupaarungal.com
casinorates.online
8ug4as.icu
Targets
-
-
Target
Elektronik Odeme Bilgileri Swift mesaji makbuzu 20230322_8755450T.exe
-
Size
800KB
-
MD5
f012f4e4f4bc3d5989ec7e74574567d9
-
SHA1
c130806d7f968656825c6357a01b9809bd586637
-
SHA256
fcc1683097894f7f965dcbb2abcd28e98f4ab15e925ceaa75ae35bcf0c88f372
-
SHA512
67496a7eac21bcb95621734c38ac906f657fce34598b7d7e31524a06d6633059fdedb9e29c07d0c81298a6b0b86fdd7219a0b862111984eba9e992b06fac3d45
-
SSDEEP
24576:FZHsZLj9epRclsNQ5Vzd1LWOqNt/w4Qz2Dw:FhsZLBepRclLHLOxw4W20
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Formbook payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Suspicious use of SetThreadContext
-