General
-
Target
e08cc96789886667def8d2d72520d25f
-
Size
477KB
-
Sample
240327-cyh87saf23
-
MD5
e08cc96789886667def8d2d72520d25f
-
SHA1
cb7764cbd49da01a6b66553644fb3e84c70669d7
-
SHA256
9ededd53a7b7f060dd6c315331fe8bd20c5c69d4dfe6ca1346b55405731381b6
-
SHA512
7a49c1527307a81a9f6e04b02911bcae1da00d29e5110c76585132db5a657ba35ffa1fa32e6a100a6b7c5ad880b5a9453eb96f3bad527bc076571eb0b918f88f
-
SSDEEP
6144:SJzKf/zmCja4qQmQCrcbnFuuUcTFx0T21BOcCSaa1MSSB6T1KpQcHCbhp:SJY1ja4qQ+rcbFudkuN/S/1MSSPQcHKP
Malware Config
Extracted
formbook
3.9
fr
geturstuff.life
kisakollections.com
bkipmtahuna.com
aoxou.com
thebigandfreeupdates.download
utvtribe.com
icontoken.com
naturexperience.com
h2sentertainmentcafe.com
careerproresumepa.com
franchiseindia.directory
psychouniversity.com
traveng.com
mylifestylebyclem.com
greentmraelty.com
imoneg.com
lupusrebelacademy.com
ghqxc.info
lylulidbd.com
dalfreestyle.com
Targets
-
-
Target
e08cc96789886667def8d2d72520d25f
-
Size
477KB
-
MD5
e08cc96789886667def8d2d72520d25f
-
SHA1
cb7764cbd49da01a6b66553644fb3e84c70669d7
-
SHA256
9ededd53a7b7f060dd6c315331fe8bd20c5c69d4dfe6ca1346b55405731381b6
-
SHA512
7a49c1527307a81a9f6e04b02911bcae1da00d29e5110c76585132db5a657ba35ffa1fa32e6a100a6b7c5ad880b5a9453eb96f3bad527bc076571eb0b918f88f
-
SSDEEP
6144:SJzKf/zmCja4qQmQCrcbnFuuUcTFx0T21BOcCSaa1MSSB6T1KpQcHCbhp:SJY1ja4qQ+rcbFudkuN/S/1MSSPQcHKP
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Formbook payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-