General
-
Target
ed70aaa765d3f4e890b381829f6ab14eef928f6fc9bc6207f83dec6695525924.zip
-
Size
585KB
-
Sample
240402-l3sg4sdh41
-
MD5
251b696c591ff34ac3a98235dc254efb
-
SHA1
11498b2d8c7b121dc2f4dcdfd25f0b8330fab151
-
SHA256
f903463f842870b76e0cfabd82454a0b633dcbef928eaea956115db3ecef5a86
-
SHA512
1292eda69679c94343353521ad814d9baa4175d0985a377ac446a9350b4645e09daf5cf510b9afb547d389359f6ce275f4ccd188467dcfaa6f89b108f4020403
-
SSDEEP
12288:iR2IhGri/XSTJioY/mL4PeHy3tDh8P48Z70y+ZxnHXY:U2IUe/gJeeLatuw8ZD+/Y
Malware Config
Extracted
formbook
4.1
dd20
unblurd.com
docu-zign.com
randijpaulsen.com
angsabet.com
sedatelynx.com
opiumcore.store
thelordismysaviormerch.com
mindstudio.support
waterbygraceteam.com
furnitureinspiredbythesea.com
amablanca.com
hespelerdental.com
arcalid.net
balajinursingbureau.online
caixias.shop
solingen-buergerstiftung.com
194916.top
6travel-insurance.xyz
xn--fiqp9b17y.xn--czr694b
syntixi.trade
Targets
-
-
Target
ed70aaa765d3f4e890b381829f6ab14eef928f6fc9bc6207f83dec6695525924.exe
-
Size
619KB
-
MD5
996f511df3eb434b0c8c8bb2f5ffac86
-
SHA1
61c47ca95118845ed58d0a95861534b2c697e073
-
SHA256
ed70aaa765d3f4e890b381829f6ab14eef928f6fc9bc6207f83dec6695525924
-
SHA512
443152150b99c31c82ef2d74e6a9bbba4b970c4863ed4527b6df299f622705c72a72d0e34f1698227cd463ed77d66322d284f8e650451dc020d2d62b69e04d13
-
SSDEEP
12288:WG2iNlw0Tpi/K61Zp5TIoc2uEj+5Qf+rdu7BrYb0kg4taHk9KnQbJUNkR:h1XLodbpOoci2Q+rdUrYQjHkcQbZ
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Formbook payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Suspicious use of SetThreadContext
-