General
-
Target
Purchase Order -263.exe
-
Size
1.2MB
-
Sample
210112-jwa17y7chn
-
MD5
eed4b5009af44f6714fedd14a013c77c
-
SHA1
2f49c70492785e3aeb7e6ff174fa86977d44def9
-
SHA256
d98998e1d6649dba775358afffb1771be64bef20f490b5a97fca770f68bf6f2a
-
SHA512
76fa3e37eebef55f819c028890a84cf22090bc7caf5c6c27b0b7a12aed949caf0a62258f1d81ee03c22d94ee2354dae3635d3f7b968e50c43ff95c3f32ba9325
Malware Config
Extracted
formbook
http://www.clivehamiltonstone.com/n925/
vrgamestickets.com
bilalproperties.com
cutfortheconnect.com
0312pifa.com
hileyjey.com
miljardairs.com
portablescoop.com
bundesregierungfinanzen.info
noorsoul.com
ediliovivas.com
findmafia.com
yourmaskslanyard.com
schmellnutrition.com
seo0577.com
slumzmusic.com
thetugdealer.com
americaflys.com
rudram.info
debsdivacollection.com
hamptonmobilenotarysvc.com
Targets
-
-
Target
Purchase Order -263.exe
-
Size
1.2MB
-
MD5
eed4b5009af44f6714fedd14a013c77c
-
SHA1
2f49c70492785e3aeb7e6ff174fa86977d44def9
-
SHA256
d98998e1d6649dba775358afffb1771be64bef20f490b5a97fca770f68bf6f2a
-
SHA512
76fa3e37eebef55f819c028890a84cf22090bc7caf5c6c27b0b7a12aed949caf0a62258f1d81ee03c22d94ee2354dae3635d3f7b968e50c43ff95c3f32ba9325
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Xloader
Xloader is a rebranded version of Formbook malware.
-
Xloader Payload
-
Suspicious use of SetThreadContext
-