General
-
Target
HSBC Payment Advice.img.exe
-
Size
720KB
-
Sample
240611-x7x4yaydld
-
MD5
271c1d8e6411be19170021ce4a896359
-
SHA1
0948954a5aba126505fce12b4336f3f02ed14f5b
-
SHA256
0effded7966d1959e7451e0a68256df8eb5c320e9721b3f4b5e2d7aace8792cf
-
SHA512
d2f887b96644707aa2e453e263f2b6ec0844801a483ad0888f2c3c6d83db01a2f3bb4ebb97ea2fa0ad8c9faa005d5aaca81c24b94ef253677cb3e50517a39f29
-
SSDEEP
12288:00XyD3HH3DI+F0dlaflXIcF4kc+4IXQtYJvUKOzC3KyAxWkR:ZXyjH3DIPdMzak14Ig6JvUKMPywN
Malware Config
Extracted
formbook
4.1
mw62
abpdainik.in
luxuryprojectmalad.co.in
cajunbellebeauty.com
fpmfstudios.com
spedyz.shop
wilddogphotographics.com
apollomoda1.com
evrimciftciportfolio.com
99977bet.com
inefavel.com
mf85.com
online-doctor-nl-1.bond
zqi2lv.vip
thewebdesignhub.co
botwitter.com
18comic-palwoeld.club
loveweldpermanentjewelry.com
l3er39pc-gaywn6kv-d7fs4t7u.cc
31yoyogamestudio.com
yhvh.cloud
Targets
-
-
Target
HSBC Payment Advice.img.exe
-
Size
720KB
-
MD5
271c1d8e6411be19170021ce4a896359
-
SHA1
0948954a5aba126505fce12b4336f3f02ed14f5b
-
SHA256
0effded7966d1959e7451e0a68256df8eb5c320e9721b3f4b5e2d7aace8792cf
-
SHA512
d2f887b96644707aa2e453e263f2b6ec0844801a483ad0888f2c3c6d83db01a2f3bb4ebb97ea2fa0ad8c9faa005d5aaca81c24b94ef253677cb3e50517a39f29
-
SSDEEP
12288:00XyD3HH3DI+F0dlaflXIcF4kc+4IXQtYJvUKOzC3KyAxWkR:ZXyjH3DIPdMzak14Ig6JvUKMPywN
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Formbook payload
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Suspicious use of SetThreadContext
-