General
-
Target
16e1a5d26c0698ac48d63661264e0ba1.exe
-
Size
639KB
-
Sample
210113-w8y51f5rqs
-
MD5
16e1a5d26c0698ac48d63661264e0ba1
-
SHA1
5e61d05157c4aa1acfc6a89de619f6bbcad176f6
-
SHA256
e4e84d03d4cb709d737f9ee3e69b40d797e452d83faa35f0a06bb78a87ad0984
-
SHA512
2b2e106e5bb198bfa88469a7c4b7b72c93e0c91e8037128033df25075c02855f9c0b4e97748cc9fb317c32ad19e3930e4274cf806ed7b7aea377734adb4d9d4e
Malware Config
Extracted
formbook
http://www.bodyfuelrtd.com/8rg4/
fakecostasunglasses.com
twinbrothers.pizza
jizhoujsp.com
qscrit.com
hotelmanise.com
fer-ua.online
europserver-simcloud.systems
redwap2.pro
betwalkoffame.com
latashalovemillionaire.com
8million-lr.com
tomatrader.com
modaluxcutabovefitness.com
shishijiazu.com
cckytx.com
reversehomeloansmiami.com
imaginenationnetwork.com
thecyclistshop.com
jorgegiljewelry.com
hlaprotiens.com
Targets
-
-
Target
16e1a5d26c0698ac48d63661264e0ba1.exe
-
Size
639KB
-
MD5
16e1a5d26c0698ac48d63661264e0ba1
-
SHA1
5e61d05157c4aa1acfc6a89de619f6bbcad176f6
-
SHA256
e4e84d03d4cb709d737f9ee3e69b40d797e452d83faa35f0a06bb78a87ad0984
-
SHA512
2b2e106e5bb198bfa88469a7c4b7b72c93e0c91e8037128033df25075c02855f9c0b4e97748cc9fb317c32ad19e3930e4274cf806ed7b7aea377734adb4d9d4e
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Xloader
Xloader is a rebranded version of Formbook malware.
-
Xloader Payload
-
Suspicious use of SetThreadContext
-