General
-
Target
0a1573dddbc69e98f2a99b1447ee2188cba36391f2abb734f701a106f31f507c
-
Size
672KB
-
Sample
230405-scksxahe2w
-
MD5
b7544b96e02d581258b4fa1951200f40
-
SHA1
8955e889ef956b54cf124260ade7e776d16a0bb4
-
SHA256
0a1573dddbc69e98f2a99b1447ee2188cba36391f2abb734f701a106f31f507c
-
SHA512
8c5f47572b1732236d85e2d9f4091bef7f908b62689b78d807fefc0d4a29b4d36e10ef4fa3f1b25c0e1d9a6a0236cf390fbf111ebb64c87a5b33f478faae82b6
-
SSDEEP
12288:6/RmSzNFHKYmWl43LaFGpaREcmQvKj6Kuwi/n84ulZXDX:6nLYWUaFGpaREc/3RrnT6
Malware Config
Extracted
formbook
4.1
n13e
cowiemarketing.com
uniqueliquidz.co.uk
755259.com
7bw95.com
luxbarstools.co.uk
baccaratda.com
berkayakpinar.xyz
gistus.africa
hjd387.com
leave-fly.com
golfclubdaddy.com
engineeringea.buzz
countryrevisited.com
decoracioneskalite.com
imaginationlirbary.com
moneytransfer.africa
brainwaveproject.com
3039sjbqf2022.com
184hotels.com
aromamiaro.com
Targets
-
-
Target
0a1573dddbc69e98f2a99b1447ee2188cba36391f2abb734f701a106f31f507c
-
Size
672KB
-
MD5
b7544b96e02d581258b4fa1951200f40
-
SHA1
8955e889ef956b54cf124260ade7e776d16a0bb4
-
SHA256
0a1573dddbc69e98f2a99b1447ee2188cba36391f2abb734f701a106f31f507c
-
SHA512
8c5f47572b1732236d85e2d9f4091bef7f908b62689b78d807fefc0d4a29b4d36e10ef4fa3f1b25c0e1d9a6a0236cf390fbf111ebb64c87a5b33f478faae82b6
-
SSDEEP
12288:6/RmSzNFHKYmWl43LaFGpaREcmQvKj6Kuwi/n84ulZXDX:6nLYWUaFGpaREc/3RrnT6
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Formbook payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Suspicious use of SetThreadContext
-