General
-
Target
rcomutationoda.exe
-
Size
836KB
-
Sample
230328-mwnq1scc2v
-
MD5
2e8c12638c2405967c54475f8a9fb9db
-
SHA1
cec044b21cf8a2cb280dadb6b842675e71cb1745
-
SHA256
ca48510ff7ad5639918292722adaac43494e43c83aa5439503f2c26628345b53
-
SHA512
ac094e6af75f261234cc2d14c54b15a04c47c853d156888b2a6e04f14282d06e3ab2e8e59656e19998289b56a495737d94413b79ba1a745cf4940125699250a9
-
SSDEEP
12288:jtbyZtmbKlAYbVQHFCTGUB3afYFSYROXGc2fvqhHYCN80hBCvtD:jIzmbKlAmVcCTtkYvRNv6lNFhBCvtD
Malware Config
Extracted
formbook
4.1
n13e
cowiemarketing.com
uniqueliquidz.co.uk
755259.com
7bw95.com
luxbarstools.co.uk
baccaratda.com
berkayakpinar.xyz
gistus.africa
hjd387.com
leave-fly.com
golfclubdaddy.com
engineeringea.buzz
countryrevisited.com
decoracioneskalite.com
imaginationlirbary.com
moneytransfer.africa
brainwaveproject.com
3039sjbqf2022.com
184hotels.com
aromamiaro.com
Targets
-
-
Target
rcomutationoda.exe
-
Size
836KB
-
MD5
2e8c12638c2405967c54475f8a9fb9db
-
SHA1
cec044b21cf8a2cb280dadb6b842675e71cb1745
-
SHA256
ca48510ff7ad5639918292722adaac43494e43c83aa5439503f2c26628345b53
-
SHA512
ac094e6af75f261234cc2d14c54b15a04c47c853d156888b2a6e04f14282d06e3ab2e8e59656e19998289b56a495737d94413b79ba1a745cf4940125699250a9
-
SSDEEP
12288:jtbyZtmbKlAYbVQHFCTGUB3afYFSYROXGc2fvqhHYCN80hBCvtD:jIzmbKlAmVcCTtkYvRNv6lNFhBCvtD
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Formbook payload
-
Blocklisted process makes network request
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Suspicious use of SetThreadContext
-