General
-
Target
2a669943885bf4566bfd7dca997ec406b34368450e1b41a01cfc65c0de92d764
-
Size
859KB
-
Sample
240308-25am3shf65
-
MD5
68f382de8e30540a2757aff591a4bf6f
-
SHA1
487134fd86371426bf0982ba40da9ffd4b44d7dd
-
SHA256
2a669943885bf4566bfd7dca997ec406b34368450e1b41a01cfc65c0de92d764
-
SHA512
5fff99e691e17aedae9df6e4896af790886f82e45086dee1f6a454ed35df4f5c29084830d491e213f276d191f2ab813a52e62cc72f84f33ce9fc0998f423603a
-
SSDEEP
12288:ZqXsd0wFzNFJmpjIjNh3fEWupqdmTX1CAiNGs/Or:ZqXsdRlHojIZxfEW2wm
Malware Config
Extracted
formbook
4.1
g2fg
snowcrash.website
pointman.us
newheartvalve.care
drandl.com
sandspringsramblers.com
programagubernamental.online
boja.us
mvrsnike.com
mentallyillmotherhood.com
facom.us
programagubernamental.store
izivente.com
roller-v.fr
amazonbioactives.com
metaverseapple.xyz
5gt-mobilevsverizon.com
gtwebsolutions.co
scottdunn.life
usdp.trade
pikmin.run
Targets
-
-
Target
2a669943885bf4566bfd7dca997ec406b34368450e1b41a01cfc65c0de92d764
-
Size
859KB
-
MD5
68f382de8e30540a2757aff591a4bf6f
-
SHA1
487134fd86371426bf0982ba40da9ffd4b44d7dd
-
SHA256
2a669943885bf4566bfd7dca997ec406b34368450e1b41a01cfc65c0de92d764
-
SHA512
5fff99e691e17aedae9df6e4896af790886f82e45086dee1f6a454ed35df4f5c29084830d491e213f276d191f2ab813a52e62cc72f84f33ce9fc0998f423603a
-
SSDEEP
12288:ZqXsd0wFzNFJmpjIjNh3fEWupqdmTX1CAiNGs/Or:ZqXsdRlHojIZxfEW2wm
Score10/10-
Detect ZGRat V1
-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
ZGRat
ZGRat is remote access trojan written in C#.
-
Formbook payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Suspicious use of SetThreadContext
-