Resubmissions
17-05-2024 13:34
240517-qvapjsag93 10General
-
Target
80bc491f53143f0586753066eff8912b356258afe443f5d0f74ef9b36703225c.xlsm
-
Size
57KB
-
Sample
240517-qvapjsag93
-
MD5
49fbdfeeae6102f667899001e34cc40a
-
SHA1
0538c187474e653f877fe6cb92cd0e4e6cf00ec6
-
SHA256
80bc491f53143f0586753066eff8912b356258afe443f5d0f74ef9b36703225c
-
SHA512
b1487ffbb8ba6c5b7eb33738ab65323d715a0d2f5238f65b4dfc1d65a72200fdc18b889ce952fc9e4e02535528d7b3d653680290890b525cde0b24a898d283c2
-
SSDEEP
1536:OwCabiKWDDSlECVV/rm8h+DVxVevyhc3W74:O8flECjzm8hBvwc3M4
Malware Config
Extracted
formbook
4.1
dn03
almouranipainting.com
cataloguia.shop
zaparielectric.com
whcqsc.com
ioco.in
aduredmond.com
vavada611a.fun
humtivers.com
jewellerytml.com
mcapitalparticipacoes.com
inhlcq.shop
solanamall.xyz
moviepropgroup.com
thegenesis.ltd
cyberxdefend.com
skinbykoco.com
entermintlead.com
honestaireviews.com
wyclhj7gqfustzp.buzz
w937xb.com
Targets
-
-
Target
80bc491f53143f0586753066eff8912b356258afe443f5d0f74ef9b36703225c.xlsm
-
Size
57KB
-
MD5
49fbdfeeae6102f667899001e34cc40a
-
SHA1
0538c187474e653f877fe6cb92cd0e4e6cf00ec6
-
SHA256
80bc491f53143f0586753066eff8912b356258afe443f5d0f74ef9b36703225c
-
SHA512
b1487ffbb8ba6c5b7eb33738ab65323d715a0d2f5238f65b4dfc1d65a72200fdc18b889ce952fc9e4e02535528d7b3d653680290890b525cde0b24a898d283c2
-
SSDEEP
1536:OwCabiKWDDSlECVV/rm8h+DVxVevyhc3W74:O8flECjzm8hBvwc3M4
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Formbook payload
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Downloads MZ/PE file
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Suspicious use of SetThreadContext
-