General
-
Target
d0b2e715c3e584846f591401035609b4.exe
-
Size
983KB
-
Sample
210114-kf6d7q4e5s
-
MD5
d0b2e715c3e584846f591401035609b4
-
SHA1
7f7a397d28920049e779b52e2de3b110f3e1b41b
-
SHA256
3579fdebe1647aa6a9172a2d808fa43b66a9ebc0e09aba02e1ed70d74dad67e2
-
SHA512
076bcaf8dbbf52b4cd3a6275c908e6992dabbfa5f3afbb9ad0cb65fdd48d8a54908ab0aabee3aae1ee9f069482c7cd32aee9b8397caa1f12d6e437b8cf757fbb
Malware Config
Extracted
formbook
http://www.rizrvd.com/bw82/
fundamentaliemef.com
gallerybrows.com
leadeligey.com
octoberx2.online
climaxnovels.com
gdsjgf.com
curateherstories.com
blacksailus.com
yjpps.com
gmobilet.com
fcoins.club
foreverlive2027.com
healthyfifties.com
wmarquezy.com
housebulb.com
thebabyfriendly.com
primajayaintiperkasa.com
learnplaychess.com
chrisbubser.digital
xn--avenr-wsa.com
Targets
-
-
Target
d0b2e715c3e584846f591401035609b4.exe
-
Size
983KB
-
MD5
d0b2e715c3e584846f591401035609b4
-
SHA1
7f7a397d28920049e779b52e2de3b110f3e1b41b
-
SHA256
3579fdebe1647aa6a9172a2d808fa43b66a9ebc0e09aba02e1ed70d74dad67e2
-
SHA512
076bcaf8dbbf52b4cd3a6275c908e6992dabbfa5f3afbb9ad0cb65fdd48d8a54908ab0aabee3aae1ee9f069482c7cd32aee9b8397caa1f12d6e437b8cf757fbb
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Xloader
Xloader is a rebranded version of Formbook malware.
-
Xloader Payload
-
Suspicious use of SetThreadContext
-