General
-
Target
2024-06-24_fbf01e7b1520736595417ae322402ecf_hiddentear
-
Size
699KB
-
Sample
240624-eprkbsxamg
-
MD5
fbf01e7b1520736595417ae322402ecf
-
SHA1
235a8c1bc504e09dc7a0d48382d45392076dada0
-
SHA256
c4215902948729d99513b7969979667aca3d05d45300989448b52769163c990b
-
SHA512
ad2d158e3c133fdb9452c753513ad7f0b2daf7fca930f55108ade37d21ab37f8d5fba31e4b7efbd4c476f504efb3a5b3ce4686cb268dc0103471deb85de4d840
-
SSDEEP
12288:FMzQsCZBCotU1/Em1fo2vvOTbD9ZRPHc7iNkkcJLXjpZ+KdAAkkR:FbdUEefnvsDLpcGcJLTSYAm
Malware Config
Extracted
formbook
4.1
dd20
unblurd.com
docu-zign.com
randijpaulsen.com
angsabet.com
sedatelynx.com
opiumcore.store
thelordismysaviormerch.com
mindstudio.support
waterbygraceteam.com
furnitureinspiredbythesea.com
amablanca.com
hespelerdental.com
arcalid.net
balajinursingbureau.online
caixias.shop
solingen-buergerstiftung.com
194916.top
6travel-insurance.xyz
xn--fiqp9b17y.xn--czr694b
syntixi.trade
Targets
-
-
Target
2024-06-24_fbf01e7b1520736595417ae322402ecf_hiddentear
-
Size
699KB
-
MD5
fbf01e7b1520736595417ae322402ecf
-
SHA1
235a8c1bc504e09dc7a0d48382d45392076dada0
-
SHA256
c4215902948729d99513b7969979667aca3d05d45300989448b52769163c990b
-
SHA512
ad2d158e3c133fdb9452c753513ad7f0b2daf7fca930f55108ade37d21ab37f8d5fba31e4b7efbd4c476f504efb3a5b3ce4686cb268dc0103471deb85de4d840
-
SSDEEP
12288:FMzQsCZBCotU1/Em1fo2vvOTbD9ZRPHc7iNkkcJLXjpZ+KdAAkkR:FbdUEefnvsDLpcGcJLTSYAm
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Detects executables packed with SmartAssembly
-
Formbook payload
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Suspicious use of SetThreadContext
-