General
-
Target
139f804af6727f40136efc05b3810f07_JaffaCakes118
-
Size
724KB
-
Sample
240329-all38ada76
-
MD5
139f804af6727f40136efc05b3810f07
-
SHA1
4e91c652e3fc8efaf060f39d2a31ae09b1b57090
-
SHA256
2d660b816d3e2c96db56d5d2e6743b8e649c63dda5e46327b5dbffdceab1d499
-
SHA512
cc037549c0e1dcde4ed7109709e9450a9370538fb1be3fdef03557e758209520c35b3ddefe61b7fdd8a1358a848ec9797ef8326f656c97ff880cdec37428f04f
-
SSDEEP
6144:Jo3K9Dnnyx65H+MfjJN5M/lqLuyRkXBymUQOuRH6vDdpQ2T7BxzaJK+Go6Uq2A:JocqGJaJ7BzUQOuR0RpQKExGZUi
Malware Config
Extracted
formbook
4.1
hs3h
slairt.com
teresasellsflorida.com
resouthcarolina.com
npccfbf.com
hutshed.com
westatesmarking.com
rustmonkeys.com
kagawa-rentacar.com
easyvoip-system.com
admorinsulation.com
ericaleighjensen.com
zhonghaojiaju.net
apple-iphone.xyz
b0t.info
torgetmc.xyz
lawrencemargarse.com
6123655.com
macdonalds-delivery.com
cvpfl.com
ayudaparaturent.com
Targets
-
-
Target
139f804af6727f40136efc05b3810f07_JaffaCakes118
-
Size
724KB
-
MD5
139f804af6727f40136efc05b3810f07
-
SHA1
4e91c652e3fc8efaf060f39d2a31ae09b1b57090
-
SHA256
2d660b816d3e2c96db56d5d2e6743b8e649c63dda5e46327b5dbffdceab1d499
-
SHA512
cc037549c0e1dcde4ed7109709e9450a9370538fb1be3fdef03557e758209520c35b3ddefe61b7fdd8a1358a848ec9797ef8326f656c97ff880cdec37428f04f
-
SSDEEP
6144:Jo3K9Dnnyx65H+MfjJN5M/lqLuyRkXBymUQOuRH6vDdpQ2T7BxzaJK+Go6Uq2A:JocqGJaJ7BzUQOuR0RpQKExGZUi
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Formbook payload
-
Looks for VirtualBox Guest Additions in registry
-
Looks for VMWare Tools registry key
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Maps connected drives based on registry
Disk information is often read in order to detect sandboxing environments.
-
Suspicious use of SetThreadContext
-