General
-
Target
9778714462.zip
-
Size
741KB
-
Sample
230329-s4nc4sgh52
-
MD5
49a3a6b42bd83e6210656b7af637112e
-
SHA1
a537d6592f30a3f61efae231469e1e1adf0167aa
-
SHA256
c24705c938ebe1c8434756475206932b421cade09d4b687c09c9ceccc0828b85
-
SHA512
18abd1bf3b04996fabd7439db72757ca1f5986af4087d5885bd82c12f12616de8db2425a156a66fd17b3b29e565d6050863e15bc571dd605b712315ab2f77816
-
SSDEEP
12288:M4+Gbbp0c2qjqXBUu/vFjPdG/O1XAgC2NrowEfT1Cr7p7FXoRhpL:LScoKgNjPdG29AgC21EK7HXozpL
Malware Config
Extracted
formbook
4.1
g2fg
snowcrash.website
pointman.us
newheartvalve.care
drandl.com
sandspringsramblers.com
programagubernamental.online
boja.us
mvrsnike.com
mentallyillmotherhood.com
facom.us
programagubernamental.store
izivente.com
roller-v.fr
amazonbioactives.com
metaverseapple.xyz
5gt-mobilevsverizon.com
gtwebsolutions.co
scottdunn.life
usdp.trade
pikmin.run
Targets
-
-
Target
abbc3fed4f82fe9afe22de485ec621e13bb0890d633e9c57ba5ebb2fe66b7159
-
Size
812KB
-
MD5
4f57c474b77a208ee4d212894b3512d2
-
SHA1
41d369bc50e40fc80054e215d3b2ff44be10c08e
-
SHA256
abbc3fed4f82fe9afe22de485ec621e13bb0890d633e9c57ba5ebb2fe66b7159
-
SHA512
0d7efaba27a0564ed224edc0fba642e93676d3c2c561a58887ca925870bc09eb1dda9b9617428247761386aff630ad052a832f698b054d434b82456e80707d25
-
SSDEEP
24576:0EXVZ9a++LeZLGjl66eaCku6e4XCi/EJq9:330LDJUaCG1wJq
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Formbook payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Suspicious use of SetThreadContext
-