General
-
Target
38301c250d764f40143b6a88d999de1a.exe
-
Size
909KB
-
Sample
210114-2x8cy4txc6
-
MD5
38301c250d764f40143b6a88d999de1a
-
SHA1
fdc439f83852aefcd6bf4063ca98e7ab9551d5aa
-
SHA256
373978ea9f4ae282536f4991ffac268b5597b69c399633ca9e2f97b8dbd01c6f
-
SHA512
7e9d1e9fb9b726e6e96f38e779fc4260ca742bc5c54936a84fc93cfa6e93ab4d89fc37ad9b8307246aef163336e5be81dc158da7fe0318c30633d867ee228a1e
Malware Config
Extracted
formbook
http://www.bodyfuelrtd.com/8rg4/
fakecostasunglasses.com
twinbrothers.pizza
jizhoujsp.com
qscrit.com
hotelmanise.com
fer-ua.online
europserver-simcloud.systems
redwap2.pro
betwalkoffame.com
latashalovemillionaire.com
8million-lr.com
tomatrader.com
modaluxcutabovefitness.com
shishijiazu.com
cckytx.com
reversehomeloansmiami.com
imaginenationnetwork.com
thecyclistshop.com
jorgegiljewelry.com
hlaprotiens.com
Targets
-
-
Target
38301c250d764f40143b6a88d999de1a.exe
-
Size
909KB
-
MD5
38301c250d764f40143b6a88d999de1a
-
SHA1
fdc439f83852aefcd6bf4063ca98e7ab9551d5aa
-
SHA256
373978ea9f4ae282536f4991ffac268b5597b69c399633ca9e2f97b8dbd01c6f
-
SHA512
7e9d1e9fb9b726e6e96f38e779fc4260ca742bc5c54936a84fc93cfa6e93ab4d89fc37ad9b8307246aef163336e5be81dc158da7fe0318c30633d867ee228a1e
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Xloader
Xloader is a rebranded version of Formbook malware.
-
Xloader Payload
-
Suspicious use of SetThreadContext
-