General
-
Target
Factura379292.vbs
-
Size
167KB
-
Sample
240325-txh1gscg68
-
MD5
434d31ae787eaa00581d957487abe814
-
SHA1
85abbe0d2e47a3128a9c94c77395cc33cc7a4da8
-
SHA256
7c50209f50ce49960450dec8780918a112576c2034ac10d70e569693434bc23a
-
SHA512
feafe13d3d5328ab4a8907a2999b6f8ae9182cd4c3758f9b081571eb367825958b8ccded5f74b65744a761b874f7924dc37d703ad55afd3f73d672ae5bfe6a95
-
SSDEEP
3072:VpK6/PeadLaz+kxSzn9Lj7rZeqGbHfNcckB+HGuG5Elx7d5czQON8DTIK/BXH:VpKyPeadLaz+k0zn1j7rZeqGbHfNcckI
Malware Config
Extracted
formbook
4.1
mo46
mnt75.link
3531.vip
mtb-treasusry.com
jgdripcases.com
fuwnjq5d.shop
viralking.shop
eternalflorist.store
fangsgang.media
healthinsuranceudeserve.com
nomadadvertiser.com
iwuqb.pics
marlboro-nissan.com
massagemdossonhos.online
guhapplay.com
ingenieriaautomotriz56.com
email-555.com
mirarestaurants.com
theblueflamelabs.us
floristeriatheclover.com
mpmngr.online
Targets
-
-
Target
Factura379292.vbs
-
Size
167KB
-
MD5
434d31ae787eaa00581d957487abe814
-
SHA1
85abbe0d2e47a3128a9c94c77395cc33cc7a4da8
-
SHA256
7c50209f50ce49960450dec8780918a112576c2034ac10d70e569693434bc23a
-
SHA512
feafe13d3d5328ab4a8907a2999b6f8ae9182cd4c3758f9b081571eb367825958b8ccded5f74b65744a761b874f7924dc37d703ad55afd3f73d672ae5bfe6a95
-
SSDEEP
3072:VpK6/PeadLaz+kxSzn9Lj7rZeqGbHfNcckB+HGuG5Elx7d5czQON8DTIK/BXH:VpKyPeadLaz+k0zn1j7rZeqGbHfNcckI
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
-
Formbook payload
-
Adds policy Run key to start application
-
Blocklisted process makes network request
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Adds Run key to start application
-
Legitimate hosting services abused for malware hosting/C2
-
Suspicious use of NtCreateThreadExHideFromDebugger
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
Suspicious use of SetThreadContext
-