General
-
Target
nDHL-SHIPPING-CONFIRMATION-383837747733.lzh
-
Size
6KB
-
Sample
240327-jh4crsff56
-
MD5
68ad72a982c62054a37f10115ed06d05
-
SHA1
ccdebb60e5b0dd23ced0ea778bf46059aff9ce9e
-
SHA256
2225611e08aca3d246e2a7a57be5a7403fe329907e11f417e00c944fcde225da
-
SHA512
5b1bb95dccb23d8b9b36b328d71da1e86769ae6e47881c6162760d8047c208061926233d009391cecd54421ac485ce83f34d24465d11c7ab8f4165ca2c87589f
-
SSDEEP
192:Ei16AT9Jk3D4Kfcng2zcEMhvT1eF2KvIb3c:Ei16YJyD4KfcPwhMvIbM
Malware Config
Extracted
formbook
4.1
tt15
wholeplant.online
pornimmersive.site
gelcreativecollabs.com
novanewsbrasil.com
prefabhomes2024th.space
stelautosrl.online
wellnessmindfulhealth.com
qhgly.lol
thefutureshub.com
compk5l.info
insurance-offers.com
de-solarroof.today
pn-pasarwajo.com
rachelelice.com
inkninsight.com
innoviewclinical.com
austrofoods.com
mayanlanguagesaccess.co
ablaiserver.com
staffcanteencook200.buzz
Targets
-
-
Target
DHL-SHIPPING-CONFIRMATION-383837747733.vbs
-
Size
10KB
-
MD5
83741a566ed8044f4692b4070986ecb9
-
SHA1
921fa0b4bbe043a6a2a9b972bceab1088acda6f5
-
SHA256
aeff431cde6f10580b664967efe9793aa19130934b0e9f9d01d152e028fa3f2a
-
SHA512
a4449f4ec76b25d0a8802afb93791c4522b1fcd14401349172d57ca93817a249b6fa8df2119b76ea3f76a9826592e54de17f0012b9d24d3fcc07bce7fa37bbde
-
SSDEEP
192:2M+7O579hFNNFU4wlr4ZRR/038AVVtkfLda+V9+ZMoce5QmDRs4ngSN+:2M+7O57dFU4wlr4r038AVQfL4+SZt13w
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
-
Formbook payload
-
Adds policy Run key to start application
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application
-
Suspicious use of NtCreateThreadExHideFromDebugger
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
Suspicious use of SetThreadContext
-