General
-
Target
0e17be44ab5949aa7e8c435c724d7fe4.bin
-
Size
517KB
-
Sample
230510-bc7h8sfe3x
-
MD5
9e31c33d7265ec69704f6bf8e3279518
-
SHA1
5cae480df265561bbf3f1b8bfc55d1c733c252ad
-
SHA256
87ad690dacfe8e2be2c9282c560eabc774b53c364d978236ce4a3f275f0d0fbb
-
SHA512
311cf22b03c9b8b53c77274a6d9e6373cee9836e3bfeffc0afa5adb2cdd9b0a841bd7f9c16e99ed6e1964ac8a60264758255b3d63e2d7ae6d5e48697870fed07
-
SSDEEP
12288:ysIKSjdqCb7TlNAdMluUd02rthgLXuaDHCFk:WKSjdqCb7TweluUW2rtKLeaDiO
Malware Config
Extracted
formbook
4.1
m82
jamesdevereux.com
artificialturfminneapolis.com
hongmeiyan.com
lojaderoupasbr.com
yit.africa
austinrelocationexpert.com
saiva.page
exitsategy.com
chochonux.com
klosterbraeu-unterliezheim.com
byseymanur.com
sblwarwickshire.co.uk
brazimaid.com
ciogame.com
bronzesailing.com
dwkapl.xyz
022dyd.com
compassandpathwriting.com
alphabet1x.com
selfcleaninghairbrush.co.uk
Targets
-
-
Target
c1a8208a8af8fb2ab397e586ea8a7f265921e6f21eb592af42a8f5c805d18557.exe
-
Size
586KB
-
MD5
0e17be44ab5949aa7e8c435c724d7fe4
-
SHA1
1ecd4bc58605af6eb4566fc14df40275523dbe8b
-
SHA256
c1a8208a8af8fb2ab397e586ea8a7f265921e6f21eb592af42a8f5c805d18557
-
SHA512
c766ae02363a7935da65d5173abd1a9a6371d258a6f323bbfb6a8e785c503c39a4cd945b85febe2acbbeced309678cc77511433e366e0215b121133cb85cc536
-
SSDEEP
12288:NHTZxe6aa8B9y8y04ogPZn96ryMj4+7hBQarT:NHNxe6r04hnQ9B
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Formbook payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Suspicious use of SetThreadContext
-