General
-
Target
Documento di richiesta di preventivo NR_531 28 05 24.exe
-
Size
614KB
-
Sample
240528-wa6jdadg3t
-
MD5
b8ee689052dfbe72f275dcae7df2e31c
-
SHA1
fbeb1c2c56f0b5f7c5aacfe6ffd1b09a961a10b2
-
SHA256
c91c2f084fcad441661842ee87995440960cda62391d260e5ff572f400d883af
-
SHA512
f4c6891ccedcde76a51249a451a8631e954ede15c3c52edde949c078462e454f1942980eee80f8b94af6bf602457888aeb86c4dde4ad75dca2addda1e815c690
-
SSDEEP
12288:mfCVUdm3+uNWMshlyN1bwYhhkK71YOvkFnSI+9+no5B0cN9Om:miUY3+uYMshlyN1bwM6AvMFc9c5crB
Malware Config
Extracted
formbook
4.1
pz12
paucanyes.com
autonwheels.com
cowboysandcaviarbar.com
fitnessengineeredworkouts.com
nuevobajonfavorito.com
dflx8.com
rothability.com
sxybet88.com
onesource.live
brenjitu1904.com
airdrop-zero1labs.com
guangdongqiangzhetc.com
apartments-for-rent-72254.bond
ombak99.lol
qqfoodsolutions.com
kyyzz.com
thepicklematch.com
ainth.com
missorris.com
gabbygomez.com
Targets
-
-
Target
Documento di richiesta di preventivo NR_531 28 05 24.exe
-
Size
614KB
-
MD5
b8ee689052dfbe72f275dcae7df2e31c
-
SHA1
fbeb1c2c56f0b5f7c5aacfe6ffd1b09a961a10b2
-
SHA256
c91c2f084fcad441661842ee87995440960cda62391d260e5ff572f400d883af
-
SHA512
f4c6891ccedcde76a51249a451a8631e954ede15c3c52edde949c078462e454f1942980eee80f8b94af6bf602457888aeb86c4dde4ad75dca2addda1e815c690
-
SSDEEP
12288:mfCVUdm3+uNWMshlyN1bwYhhkK71YOvkFnSI+9+no5B0cN9Om:miUY3+uYMshlyN1bwM6AvMFc9c5crB
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Formbook payload
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Suspicious use of SetThreadContext
-