General
-
Target
Shipping Document PL&BL Draft.exe
-
Size
322KB
-
Sample
210115-d24c1hgy6n
-
MD5
a0614d41b6280e3f8bce2015eb4ba7aa
-
SHA1
ffe5c224de394e76c0a971d56576efb36e68aff9
-
SHA256
bcba31709cecf79a6996bda8b48a9e891db6de827c852404634a96d248560ba3
-
SHA512
eeb581210b8a20b9d5629170ea53a0f7157daf875489707ab6c894cab84aa244b65efa28dd62d81512a61acf64e7aadd2cedc529c4fd42b32b09a37020b23377
Malware Config
Extracted
formbook
http://www.elevatedenterprizes.com/h3qo/
dhflow.com
jyindex.com
ezcleanhandle.com
trungtamcongdong.online
simsprotectionagency.com
easylivemeet.com
blackvikingfashionhouse.com
52banxue.com
girlsinit.com
drhemo.com
freethefarmers.com
velvetrosephotography.com
geometricbotaniclas.com
skyandspirit.com
deltacomunicacao.com
mucademy.com
jaboilfieldsolutions.net
howtowinatblackjacknow.com
anytimegrowth.com
simranluthra.com
Targets
-
-
Target
Shipping Document PL&BL Draft.exe
-
Size
322KB
-
MD5
a0614d41b6280e3f8bce2015eb4ba7aa
-
SHA1
ffe5c224de394e76c0a971d56576efb36e68aff9
-
SHA256
bcba31709cecf79a6996bda8b48a9e891db6de827c852404634a96d248560ba3
-
SHA512
eeb581210b8a20b9d5629170ea53a0f7157daf875489707ab6c894cab84aa244b65efa28dd62d81512a61acf64e7aadd2cedc529c4fd42b32b09a37020b23377
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Xloader
Xloader is a rebranded version of Formbook malware.
-
Xloader Payload
-
Deletes itself
-
Suspicious use of SetThreadContext
-