General
- Target 5aa864c747cc682954fff5164d2f9d7dfd6055c7a354faeb7bcd02db9fdb2649
- Size 6KB
- Sample261006-d8hwvs1xd1
- SHA256 5aa864c747cc682954fff5164d2f9d7dfd6055c7a354faeb7bcd02db9fdb2649
Score
10/10
Malware Config
Targets
-
- Target 至急のお見積もり依頼.js
- Size 25KB
- SHA256 a834ac8699c5b2fc4e1e9ad8cc7d98b9da6a976de91cc048ca2864ad846399fe
Score10/10Family: Formbook
Formbook is a data stealing malware which is capable of stealing data.
Formbook payload
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Accesses Microsoft Outlook profiles
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
Suspicious use of SetThreadContext