General
-
Target
Bank_Payment_Advise_Scanned_doc.vbs
-
Size
10KB
-
Sample
240325-txh1gsff2t
-
MD5
83741a566ed8044f4692b4070986ecb9
-
SHA1
921fa0b4bbe043a6a2a9b972bceab1088acda6f5
-
SHA256
aeff431cde6f10580b664967efe9793aa19130934b0e9f9d01d152e028fa3f2a
-
SHA512
a4449f4ec76b25d0a8802afb93791c4522b1fcd14401349172d57ca93817a249b6fa8df2119b76ea3f76a9826592e54de17f0012b9d24d3fcc07bce7fa37bbde
-
SSDEEP
192:2M+7O579hFNNFU4wlr4ZRR/038AVVtkfLda+V9+ZMoce5QmDRs4ngSN+:2M+7O57dFU4wlr4r038AVQfL4+SZt13w
Malware Config
Extracted
formbook
4.1
tt15
wholeplant.online
pornimmersive.site
gelcreativecollabs.com
novanewsbrasil.com
prefabhomes2024th.space
stelautosrl.online
wellnessmindfulhealth.com
qhgly.lol
thefutureshub.com
compk5l.info
insurance-offers.com
de-solarroof.today
pn-pasarwajo.com
rachelelice.com
inkninsight.com
innoviewclinical.com
austrofoods.com
mayanlanguagesaccess.co
ablaiserver.com
staffcanteencook200.buzz
Targets
-
-
Target
Bank_Payment_Advise_Scanned_doc.vbs
-
Size
10KB
-
MD5
83741a566ed8044f4692b4070986ecb9
-
SHA1
921fa0b4bbe043a6a2a9b972bceab1088acda6f5
-
SHA256
aeff431cde6f10580b664967efe9793aa19130934b0e9f9d01d152e028fa3f2a
-
SHA512
a4449f4ec76b25d0a8802afb93791c4522b1fcd14401349172d57ca93817a249b6fa8df2119b76ea3f76a9826592e54de17f0012b9d24d3fcc07bce7fa37bbde
-
SSDEEP
192:2M+7O579hFNNFU4wlr4ZRR/038AVVtkfLda+V9+ZMoce5QmDRs4ngSN+:2M+7O57dFU4wlr4r038AVQfL4+SZt13w
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
-
Formbook payload
-
Adds policy Run key to start application
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application
-
Suspicious use of NtCreateThreadExHideFromDebugger
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
Suspicious use of SetThreadContext
-