General
-
Target
MT103 Remittance.gz
-
Size
610B
-
Sample
240410-pbcjcsac3x
-
MD5
6e2529cf9b4327ca137f1b6e3ea3a421
-
SHA1
3cdcb601d028413134cfbf1e37939a51c7c98d3d
-
SHA256
7a9b8962b3ac07030065cc89b463c37f61ad7d36807b5f5c57fa6d841f3c2613
-
SHA512
8563760d6299c936654bbaa3dd50417ecd60618de644095b66395cbb1a3ba25562a7b96c95a066dd440b13ce3860a717dcd94550c2edec3a68dbac2d131bf4a5
Malware Config
Extracted
formbook
4.1
m07a
shakishaskakes.com
com222.shop
thailand-package.in
apexu.xyz
xlmagnemite.com
nagapura.com
auralights.store
springupfashionsalon.com
ecoessentiaer.shop
myorra.com
xasvcd.xyz
zachbynesdesigns.art
qdaoxingsujiao.com
workproapi.site
pbmengineering.com
cioccasubaruspecials.com
tmotest.com
yipaijihejiaoyu.com
msaway.com
jfn3d.cc
Targets
-
-
Target
MT103 Remittance.vbs
-
Size
1KB
-
MD5
c4231941df80798bdcca2c73169fbd0d
-
SHA1
690026f9d90747d8f874e5cd86de1f57268971a4
-
SHA256
9fb8ccd20cec879fb4038665437e6f5ef6ead189fdfeb63b2b750f1cdc5640f4
-
SHA512
8a56e8419e6269058927bedf14c2b223cd42f59819ddd6f0da52dce70a1351455daffcde158d7be6b039b70669c66a07357fa79f8df3a2743cd3880d29d31462
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Formbook payload
-
Blocklisted process makes network request
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of SetThreadContext
-