General
-
Target
cd925558146dc80ccf028ce0e9a5c542.exe
-
Size
850KB
-
Sample
210114-5pv69pwr5n
-
MD5
cd925558146dc80ccf028ce0e9a5c542
-
SHA1
e91a37336f7c2accce48b407f622e1c2bfb7c76f
-
SHA256
41440a2e9db109558bde920dddba0eee3a5f269eef4c0d80eedf6a0bf0445a70
-
SHA512
54df05cc95e14b18c85f1621960ce32e4590b6a7ff06ac365369c3609a32a9dd9559a0ffd584532a1fa6fe591579415722159ac76c1b8bdfa9400034b72a88f4
Malware Config
Extracted
formbook
http://www.h-v-biz.com/c8so/
floeperformancegear.com
youtubeincreaser.com
cbb-is.com
bullsbikeusa.com
mama-asobitai.com
parkdaleliving.com
kinneintl.com
byrondramos.com
topangashaman.com
channel1057.com
nuancedigitalsolutions.com
kumheekim.com
erikating.com
ulinekorea.com
giftoes.com
blacknation.info
eventsdonevirtually.com
mx190501.com
bingent.info
seronofertilitymeds.com
Targets
-
-
Target
cd925558146dc80ccf028ce0e9a5c542.exe
-
Size
850KB
-
MD5
cd925558146dc80ccf028ce0e9a5c542
-
SHA1
e91a37336f7c2accce48b407f622e1c2bfb7c76f
-
SHA256
41440a2e9db109558bde920dddba0eee3a5f269eef4c0d80eedf6a0bf0445a70
-
SHA512
54df05cc95e14b18c85f1621960ce32e4590b6a7ff06ac365369c3609a32a9dd9559a0ffd584532a1fa6fe591579415722159ac76c1b8bdfa9400034b72a88f4
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Xloader
Xloader is a rebranded version of Formbook malware.
-
Xloader Payload
-
Suspicious use of SetThreadContext
-