General
-
Target
c6a79aaad7ae2619ef0a38d08af79c83.exe
-
Size
896KB
-
Sample
210111-kpg5snpbss
-
MD5
c6a79aaad7ae2619ef0a38d08af79c83
-
SHA1
8d6ef31473f3907846b532e5419bd5989375bb04
-
SHA256
a7df5fff3eb06082036dd6634fa7c5022c48ae5438e5cff66bc500906c16597e
-
SHA512
4074036556fb6b6a114173165cdb4dad324498b4d682e068ef42dff55cae52df8296e0699ecda1825e730b5642be136f181615b32eabb430760beba9eab5f7c6
Malware Config
Extracted
formbook
http://www.bodyfuelrtd.com/8rg4/
fakecostasunglasses.com
twinbrothers.pizza
jizhoujsp.com
qscrit.com
hotelmanise.com
fer-ua.online
europserver-simcloud.systems
redwap2.pro
betwalkoffame.com
latashalovemillionaire.com
8million-lr.com
tomatrader.com
modaluxcutabovefitness.com
shishijiazu.com
cckytx.com
reversehomeloansmiami.com
imaginenationnetwork.com
thecyclistshop.com
jorgegiljewelry.com
hlaprotiens.com
Targets
-
-
Target
c6a79aaad7ae2619ef0a38d08af79c83.exe
-
Size
896KB
-
MD5
c6a79aaad7ae2619ef0a38d08af79c83
-
SHA1
8d6ef31473f3907846b532e5419bd5989375bb04
-
SHA256
a7df5fff3eb06082036dd6634fa7c5022c48ae5438e5cff66bc500906c16597e
-
SHA512
4074036556fb6b6a114173165cdb4dad324498b4d682e068ef42dff55cae52df8296e0699ecda1825e730b5642be136f181615b32eabb430760beba9eab5f7c6
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Xloader
Xloader is a rebranded version of Formbook malware.
-
Xloader Payload
-
Suspicious use of SetThreadContext
-