General
-
Target
5da659b378ccc31833fdd2b4fbd1d411.exe
-
Size
1.1MB
-
Sample
210112-8533z19zl2
-
MD5
5da659b378ccc31833fdd2b4fbd1d411
-
SHA1
5572df75bfefdaa9185c37c66cb99140e924bca0
-
SHA256
cf6af1749c38b0af7660d67059470a189f593d6196c76d7739596061f8f0afc9
-
SHA512
465d218db61a561eec9ba6da2f251d430e328ea793bc2f36c78fed59853190bce344dbc52e4f05b2bb96b4c22cf7dd538a12a91be2c9c311a6c715b8d7bdfb28
Malware Config
Extracted
formbook
http://www.bodyfuelrtd.com/8rg4/
fakecostasunglasses.com
twinbrothers.pizza
jizhoujsp.com
qscrit.com
hotelmanise.com
fer-ua.online
europserver-simcloud.systems
redwap2.pro
betwalkoffame.com
latashalovemillionaire.com
8million-lr.com
tomatrader.com
modaluxcutabovefitness.com
shishijiazu.com
cckytx.com
reversehomeloansmiami.com
imaginenationnetwork.com
thecyclistshop.com
jorgegiljewelry.com
hlaprotiens.com
Targets
-
-
Target
5da659b378ccc31833fdd2b4fbd1d411.exe
-
Size
1.1MB
-
MD5
5da659b378ccc31833fdd2b4fbd1d411
-
SHA1
5572df75bfefdaa9185c37c66cb99140e924bca0
-
SHA256
cf6af1749c38b0af7660d67059470a189f593d6196c76d7739596061f8f0afc9
-
SHA512
465d218db61a561eec9ba6da2f251d430e328ea793bc2f36c78fed59853190bce344dbc52e4f05b2bb96b4c22cf7dd538a12a91be2c9c311a6c715b8d7bdfb28
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Xloader
Xloader is a rebranded version of Formbook malware.
-
Xloader Payload
-
Suspicious use of SetThreadContext
-