General
-
Target
Documents.rar
-
Size
510KB
-
Sample
230519-f79z3afc54
-
MD5
d2990163845bfa27e27d1d05830e7aac
-
SHA1
e7a9dc104295237db0333ef76213fd28a10c8983
-
SHA256
b6d32d75d7fbc40febd353387a6ce2e4b511ca9bd4468ab7bdffd1811906c248
-
SHA512
e34f155e6136da78f162ba1e67bdf3edc686a99b419b36a89190150fe4bf5f3be9a1dbddf6602a76fa91bc4c80adbc57b57a522082139002feaf2d6fd4fa750d
-
SSDEEP
12288:6KSkF7teaQfuN735mUTcu4v8Vi6ejuZnJUC+v7:ykRteaQmN7pfI70VijjuZnJWv7
Malware Config
Extracted
formbook
4.1
m82
jamesdevereux.com
artificialturfminneapolis.com
hongmeiyan.com
lojaderoupasbr.com
yit.africa
austinrelocationexpert.com
saiva.page
exitsategy.com
chochonux.com
klosterbraeu-unterliezheim.com
byseymanur.com
sblwarwickshire.co.uk
brazimaid.com
ciogame.com
bronzesailing.com
dwkapl.xyz
022dyd.com
compassandpathwriting.com
alphabet1x.com
selfcleaninghairbrush.co.uk
Targets
-
-
Target
Documents.exe
-
Size
640KB
-
MD5
24f7d407a7eff2ea62af53f7c11f2fb0
-
SHA1
d4b3db48383aba71c1ef461f84a7e001689187e7
-
SHA256
a28cb539852da2e100484ab8cee9613a28b2e68d409b99d80e27f4fb7f238b5d
-
SHA512
5d4095656b6981718fcbc82852d9cb20d73e3314d98d6cf8230c068f149e053f9000d180c8abbc98f8367282441d6c03bf140db9888495502b8b504f15527b0e
-
SSDEEP
6144:kdR80E2s4y3+3gXKuS8qc863OBV+7SUSqtiTP8jyNBaK+vsy37G3Nt1yPg1ChsXX:12zKYCKuS8tOqdRCzso1Chsboc
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Formbook payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Suspicious use of SetThreadContext
-