General
-
Target
4e1e5ed444f1dd3c1807df4b9e6c41e9e53556a80e7c28701ef6571bd081fac2
-
Size
280KB
-
Sample
230608-fams9scb53
-
MD5
c6d2ae33edf3d67a0c2abe42836c2874
-
SHA1
c29bcdccea09e6f3ecdef77fac70d96c9d8acfa3
-
SHA256
4e1e5ed444f1dd3c1807df4b9e6c41e9e53556a80e7c28701ef6571bd081fac2
-
SHA512
444c4c45ec9d5f0d7202fd76a073c8387792a1500386c34b032d523e2a27a5a5a97b6c980c6d4e6a4980ebc6da9e4fd4b3db63021c254d7c89b0390dda8b6d5c
-
SSDEEP
6144:w6dmbMKjfheEC2iP/jUzD4xVuazSnsMDC8pv3IMRhhSygcTSD9N:g4Af3ChzUPGVuazhMDZT+ygcTSDn
Malware Config
Extracted
formbook
4.1
xchu
zcartoons.com
castilloshowroom.com
3bmmdtod.life
misaxoxo.com
nadiya.online
sykkbup29.xyz
triciaaprimrosevp.com
newleter.com
ptzslk.xyz
lightbulbfestival.com
texaslandline.com
ideeintemporelle.com
girljustdoitpodcast.com
medimediamarketing.com
bunk7outfitters.com
charlievgrfminnick.click
lifestyleinthehome.com
atfbestsale.online
frontdoorproperties.co.uk
grandpaswag2024.info
Targets
-
-
Target
4e1e5ed444f1dd3c1807df4b9e6c41e9e53556a80e7c28701ef6571bd081fac2
-
Size
280KB
-
MD5
c6d2ae33edf3d67a0c2abe42836c2874
-
SHA1
c29bcdccea09e6f3ecdef77fac70d96c9d8acfa3
-
SHA256
4e1e5ed444f1dd3c1807df4b9e6c41e9e53556a80e7c28701ef6571bd081fac2
-
SHA512
444c4c45ec9d5f0d7202fd76a073c8387792a1500386c34b032d523e2a27a5a5a97b6c980c6d4e6a4980ebc6da9e4fd4b3db63021c254d7c89b0390dda8b6d5c
-
SSDEEP
6144:w6dmbMKjfheEC2iP/jUzD4xVuazSnsMDC8pv3IMRhhSygcTSD9N:g4Af3ChzUPGVuazhMDZT+ygcTSDn
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
-
Formbook payload
-
Checks QEMU agent file
Checks presence of QEMU agent, possibly to detect virtualization.
-
Loads dropped DLL
-
Suspicious use of NtCreateThreadExHideFromDebugger
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
Suspicious use of SetThreadContext
-