General
-
Target
Documents.rar
-
Size
646KB
-
Sample
230510-xw3kaabf2s
-
MD5
479f07bef8b0473e40d45f7b366898a5
-
SHA1
101b1d1e3888628c87b330c6098a869b16b91e18
-
SHA256
c7e8b70bc8170589d3b9bc120ab514227c6275312d1153686433f1aa6bc89809
-
SHA512
7b6ec92ecee212ab4789eb248e84c1fcc4756b9ca48730a764023d7f48e88a48af70b031d2ac28bd1f0ec823426ba5223c62ab86e1879386950cb6df0d2df76b
-
SSDEEP
12288:NABUV1UqpZg+ec4+1nJfbnMwQaDoOiWTy2+qXXDrcxuYBe+gE:NcUHU+g+B4+VJLqMIqXXcxuHE
Malware Config
Extracted
formbook
4.1
m82
jamesdevereux.com
artificialturfminneapolis.com
hongmeiyan.com
lojaderoupasbr.com
yit.africa
austinrelocationexpert.com
saiva.page
exitsategy.com
chochonux.com
klosterbraeu-unterliezheim.com
byseymanur.com
sblwarwickshire.co.uk
brazimaid.com
ciogame.com
bronzesailing.com
dwkapl.xyz
022dyd.com
compassandpathwriting.com
alphabet1x.com
selfcleaninghairbrush.co.uk
Targets
-
-
Target
Documents.exe
-
Size
773KB
-
MD5
fe3365e83f4a43d63e0394450e1e284d
-
SHA1
f36a3148c6220bb10b0c828cf9818e75676d920f
-
SHA256
114f4e62ec2b81ab45799a56b183ef282b2bc5c172fd9831af33c154b23034ea
-
SHA512
de3a276bfd45430cc926a3362246baf78d5de04fecf234549c6ecc219249556aad7fc9e65cadfc83a14edec9940ea1860fbb758376681bbc0bd33b19ce21b724
-
SSDEEP
12288:xdZfTbsC8pAhY42pX13LLA2qpDJzn70NsF/qBth53rSdxj:xfLb78qhIF3LLRkzF/qh536xj
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Formbook payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Suspicious use of SetThreadContext
-