General
-
Target
f012f4e4f4bc3d5989ec7e74574567d9.bin
-
Size
728KB
-
Sample
230324-ctqgqadf7t
-
MD5
0ee7971190ad42092b08bac238253a85
-
SHA1
c34cdab9a55611794ec2438d8b33f5deed094d1a
-
SHA256
5836e1b2911847abed98e1187758150e14234303c90b219ed62e6bf7d8c25fae
-
SHA512
75804c2067cd8fd1832f1f6b67f39800ed99ddc964a60dfc51741c7df645680d211a0ada1ae25101bad4dcc9db5f9c1c94aa7c0d1407b2f6f16a5314c8ff44c5
-
SSDEEP
12288:nHPnWVLF+wMDLmlfL73qaBeVYIrk9LVz11hEmVzQ1NLqzqb1:HPWRF+wMDLmxLHI6LVhztGPm2b1
Malware Config
Extracted
formbook
4.1
jr22
941zhe.com
lunarportal.space
xn--osmaniyeiek-t9ab.online
trejoscar.com
nrnursery.com
quizcannot.cfd
seedstockersthailand.com
watsonwindow.com
wjfholdings.com
weziclondon.com
naruot.xyz
yeji.plus
classicmenstore.com
oharatravel.com
therapyplankits.com
keviegreshonpt.com
qdlyner.com
seithupaarungal.com
casinorates.online
8ug4as.icu
Targets
-
-
Target
fcc1683097894f7f965dcbb2abcd28e98f4ab15e925ceaa75ae35bcf0c88f372.exe
-
Size
800KB
-
MD5
f012f4e4f4bc3d5989ec7e74574567d9
-
SHA1
c130806d7f968656825c6357a01b9809bd586637
-
SHA256
fcc1683097894f7f965dcbb2abcd28e98f4ab15e925ceaa75ae35bcf0c88f372
-
SHA512
67496a7eac21bcb95621734c38ac906f657fce34598b7d7e31524a06d6633059fdedb9e29c07d0c81298a6b0b86fdd7219a0b862111984eba9e992b06fac3d45
-
SSDEEP
24576:FZHsZLj9epRclsNQ5Vzd1LWOqNt/w4Qz2Dw:FhsZLBepRclLHLOxw4W20
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Formbook payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Suspicious use of SetThreadContext
-