General
-
Target
ed0bbf9e05f2a65461df693133b7a9c2.exe
-
Size
1.4MB
-
Sample
210114-seg7my47a2
-
MD5
ed0bbf9e05f2a65461df693133b7a9c2
-
SHA1
89eb1e20c43836da2c7f5a3ff8d51af83a08c116
-
SHA256
b96e65c2c4d2cdbe32d98e9f24a1e5f1d74bdaa0f47088cc70d48f4be730dc55
-
SHA512
6eac3e00dfb7aabb4b96d0d17c02585d46638ff4006ff07cefd36fcc7cee2a4ba669a338ba8632823b62d644adfb82c884a7bdc44f89a696636c019922ddcc2a
Malware Config
Extracted
formbook
http://www.rizrvd.com/bw82/
fundamentaliemef.com
gallerybrows.com
leadeligey.com
octoberx2.online
climaxnovels.com
gdsjgf.com
curateherstories.com
blacksailus.com
yjpps.com
gmobilet.com
fcoins.club
foreverlive2027.com
healthyfifties.com
wmarquezy.com
housebulb.com
thebabyfriendly.com
primajayaintiperkasa.com
learnplaychess.com
chrisbubser.digital
xn--avenr-wsa.com
Targets
-
-
Target
ed0bbf9e05f2a65461df693133b7a9c2.exe
-
Size
1.4MB
-
MD5
ed0bbf9e05f2a65461df693133b7a9c2
-
SHA1
89eb1e20c43836da2c7f5a3ff8d51af83a08c116
-
SHA256
b96e65c2c4d2cdbe32d98e9f24a1e5f1d74bdaa0f47088cc70d48f4be730dc55
-
SHA512
6eac3e00dfb7aabb4b96d0d17c02585d46638ff4006ff07cefd36fcc7cee2a4ba669a338ba8632823b62d644adfb82c884a7bdc44f89a696636c019922ddcc2a
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Xloader
Xloader is a rebranded version of Formbook malware.
-
Xloader Payload
-
Suspicious use of SetThreadContext
-