General
-
Target
NEW ORDER_pdf.exe
-
Size
557KB
-
Sample
210114-7lsmlemenj
-
MD5
65193381f8d655770988b43d3c16e4f2
-
SHA1
bc7c2c5497611362f923b8a5c3d7038fa0c58778
-
SHA256
f5335d6602e10c13875822341a6044ebff9bdac72b7a0aba66142db66642d594
-
SHA512
612e0ceb0045de02146e468c2eae0ede809266d58ee1d23a741ae9398f82112fd3da769502d301fc1e5ef7293c3dcc7a7fef4516f715c57e605b33d07db65a4a
Malware Config
Extracted
formbook
http://www.vkreditoff.online/hvu9/
infrapin.com
electrochimp.com
hometuitionteachers.com
cruelworldsupply.com
wesolvit.net
transferypilkarskie.com
nuovavoce.style
secundaria209emilianozapata.com
brewmastersbrigade.com
delraymessageandtherapy.com
trikeua.com
buildelectricwa.info
inspiredbylisamarie.com
keaidoo.com
cahmp.com
cockteesgolf.com
seachakravibe.store
timelesswritersgroup.com
kingdombest.net
metodologiamontessori.com
Targets
-
-
Target
NEW ORDER_pdf.exe
-
Size
557KB
-
MD5
65193381f8d655770988b43d3c16e4f2
-
SHA1
bc7c2c5497611362f923b8a5c3d7038fa0c58778
-
SHA256
f5335d6602e10c13875822341a6044ebff9bdac72b7a0aba66142db66642d594
-
SHA512
612e0ceb0045de02146e468c2eae0ede809266d58ee1d23a741ae9398f82112fd3da769502d301fc1e5ef7293c3dcc7a7fef4516f715c57e605b33d07db65a4a
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Xloader
Xloader is a rebranded version of Formbook malware.
-
Xloader Payload
-
Deletes itself
-
Suspicious use of SetThreadContext
-