General
-
Target
de380d6e306a565da0abb6c3c3a1218c
-
Size
1.5MB
-
Sample
240325-rnt1aade4y
-
MD5
de380d6e306a565da0abb6c3c3a1218c
-
SHA1
e23d9b94520ee782849891946698093c0bf5548a
-
SHA256
ff620f29513c7adf425b7689392a0f419258e6607ba99be0c710760806d1dcd1
-
SHA512
9aff49d5c86a5b5cd37b90a2489fc6b77c89abc2b8df55ba1fb2e86a6b69e8f3a11b11c7c0a267f6d333a3680338055adb0a3e6053e94e8b84c6cb5000176c00
-
SSDEEP
12288:RpLJ5xYSHm8SVu/aQofMgWgfpLc2kn3pvihfSDWEQ7lPQ6H+Uy1Susr8MmH3jR:mS9ScaQgWgR4339SeWEgloZZS5R0
Malware Config
Extracted
formbook
4.1
upio
thecantonmentcookhouse.com
1for1ecomask.com
thatvintagehome.com
momentbymomentmindfulness.com
denxmedia.com
arc-corner.com
siddharthmakharia.com
meiluk.com
toughu.com
hotelwisatabaru.com
ibluebelt3dbuy.com
bestfootwearhk.com
wbjobalerts.com
radiancenurestoringcleanse.com
xintianlongyeya.com
docauphuhau.com
liberty-furniture.com
ranchhousepizzaonline.com
bednhomes.com
kollakids.com
Targets
-
-
Target
de380d6e306a565da0abb6c3c3a1218c
-
Size
1.5MB
-
MD5
de380d6e306a565da0abb6c3c3a1218c
-
SHA1
e23d9b94520ee782849891946698093c0bf5548a
-
SHA256
ff620f29513c7adf425b7689392a0f419258e6607ba99be0c710760806d1dcd1
-
SHA512
9aff49d5c86a5b5cd37b90a2489fc6b77c89abc2b8df55ba1fb2e86a6b69e8f3a11b11c7c0a267f6d333a3680338055adb0a3e6053e94e8b84c6cb5000176c00
-
SSDEEP
12288:RpLJ5xYSHm8SVu/aQofMgWgfpLc2kn3pvihfSDWEQ7lPQ6H+Uy1Susr8MmH3jR:mS9ScaQgWgR4339SeWEgloZZS5R0
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Formbook payload
-
Looks for VirtualBox Guest Additions in registry
-
Looks for VMWare Tools registry key
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Maps connected drives based on registry
Disk information is often read in order to detect sandboxing environments.
-
Suspicious use of SetThreadContext
-