General
-
Target
BANK DETAILS.exe
-
Size
918KB
-
Sample
230519-wxkv7ahh71
-
MD5
0f6df6fe7dc22d6042a636aa9e7aeeb8
-
SHA1
6e5e210f48b2b843b98e7568ae0ebba3e17dc3c5
-
SHA256
64e9e76c9c64aa89f98ba7a6413df1c33fd3e5efeb35a7d52cb9b8b4fbe6f443
-
SHA512
733a9e58af70fc64861676d136f548949871e35c2a5d774cbc10802447e45b073acf9c2dc2caa4bf0603d71842cbe0f0ba41f29edd1fb99370fe5e52a5bb9c80
-
SSDEEP
24576:bP0tmoCXmwsmOG5KL6bWGIJmCQ73h4GJAFPNO1Rir:bP0czBsJJ1JLE+GJArO1
Malware Config
Extracted
formbook
4.1
m82
jamesdevereux.com
artificialturfminneapolis.com
hongmeiyan.com
lojaderoupasbr.com
yit.africa
austinrelocationexpert.com
saiva.page
exitsategy.com
chochonux.com
klosterbraeu-unterliezheim.com
byseymanur.com
sblwarwickshire.co.uk
brazimaid.com
ciogame.com
bronzesailing.com
dwkapl.xyz
022dyd.com
compassandpathwriting.com
alphabet1x.com
selfcleaninghairbrush.co.uk
Targets
-
-
Target
BANK DETAILS.exe
-
Size
918KB
-
MD5
0f6df6fe7dc22d6042a636aa9e7aeeb8
-
SHA1
6e5e210f48b2b843b98e7568ae0ebba3e17dc3c5
-
SHA256
64e9e76c9c64aa89f98ba7a6413df1c33fd3e5efeb35a7d52cb9b8b4fbe6f443
-
SHA512
733a9e58af70fc64861676d136f548949871e35c2a5d774cbc10802447e45b073acf9c2dc2caa4bf0603d71842cbe0f0ba41f29edd1fb99370fe5e52a5bb9c80
-
SSDEEP
24576:bP0tmoCXmwsmOG5KL6bWGIJmCQ73h4GJAFPNO1Rir:bP0czBsJJ1JLE+GJArO1
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Formbook payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Suspicious use of SetThreadContext
-