General
-
Target
Ziraat Bankasi Swift Mesaji.exe
-
Size
293KB
-
Sample
230327-mjazdsfa91
-
MD5
7211ccbff4e2557e067609dcbf6839ae
-
SHA1
0780420e2f12a4cb8e6f3fb717afba2ea7e102e0
-
SHA256
856c3482c119fdecb777d14ef351c90a24a045cf8da8cafbb2d229619cb11bbf
-
SHA512
a546bc8450b220425a3e6a70a6de0df3e98bcb8d7aa2a0dd0d533e72582c852e9a85ee002eb5260e55ac8b9344ab826d7b85de9ebf97ee0248a476c99830c751
-
SSDEEP
6144:H6+/tV2ye/x3BfF+WL/uVQXXXv+fHLhTySnjprxwPLbQ7:Pn2ye/DMWL2VCv+frh+w9W87
Malware Config
Extracted
formbook
4.1
mi94
realdigitalmarketing.co.uk
athle91.com
zetuinteriors.africa
jewelry2adore.biz
sneakersuomo.com
hotcoa.com
bestpetfinds.com
elatedfreedom.com
louisegoulet.com
licensescape.com
jenniferfalconerrealtor.com
xqan.net
textare.net
doctorlinkscsk.link
bizformspro.com
ameriealthcaritasfl.com
hanfengmeiye.com
anjin98.com
credit-cards-54889.com
dinero.news
Targets
-
-
Target
Ziraat Bankasi Swift Mesaji.exe
-
Size
293KB
-
MD5
7211ccbff4e2557e067609dcbf6839ae
-
SHA1
0780420e2f12a4cb8e6f3fb717afba2ea7e102e0
-
SHA256
856c3482c119fdecb777d14ef351c90a24a045cf8da8cafbb2d229619cb11bbf
-
SHA512
a546bc8450b220425a3e6a70a6de0df3e98bcb8d7aa2a0dd0d533e72582c852e9a85ee002eb5260e55ac8b9344ab826d7b85de9ebf97ee0248a476c99830c751
-
SSDEEP
6144:H6+/tV2ye/x3BfF+WL/uVQXXXv+fHLhTySnjprxwPLbQ7:Pn2ye/DMWL2VCv+frh+w9W87
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
-
Formbook payload
-
Checks QEMU agent file
Checks presence of QEMU agent, possibly to detect virtualization.
-
Loads dropped DLL
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of NtCreateThreadExHideFromDebugger
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
Suspicious use of SetThreadContext
-