General
-
Target
Invoice_20210115122010.scr
-
Size
295KB
-
Sample
210115-fdppcx5amx
-
MD5
ca4bbc7aa2c2cd0bf193b1fe0bbd2d49
-
SHA1
dd82900ef5f0023ebee0c44a7fd0d8bdfea6f635
-
SHA256
5b895b1fe7b66a92588a06eba17a83022da0b539dd9c2eaafbf6082a656f7b57
-
SHA512
0968a8deed84c3d6b7b8a77ade86582f67fc276450268414d695c17d7eb78f091e18107185fbb0f3bc269f928aa8763903c5fa37ece68af4863869b63ef040cd
Malware Config
Extracted
formbook
http://www.elevatedenterprizes.com/h3qo/
dhflow.com
jyindex.com
ezcleanhandle.com
trungtamcongdong.online
simsprotectionagency.com
easylivemeet.com
blackvikingfashionhouse.com
52banxue.com
girlsinit.com
drhemo.com
freethefarmers.com
velvetrosephotography.com
geometricbotaniclas.com
skyandspirit.com
deltacomunicacao.com
mucademy.com
jaboilfieldsolutions.net
howtowinatblackjacknow.com
anytimegrowth.com
simranluthra.com
Targets
-
-
Target
Invoice_20210115122010.scr
-
Size
295KB
-
MD5
ca4bbc7aa2c2cd0bf193b1fe0bbd2d49
-
SHA1
dd82900ef5f0023ebee0c44a7fd0d8bdfea6f635
-
SHA256
5b895b1fe7b66a92588a06eba17a83022da0b539dd9c2eaafbf6082a656f7b57
-
SHA512
0968a8deed84c3d6b7b8a77ade86582f67fc276450268414d695c17d7eb78f091e18107185fbb0f3bc269f928aa8763903c5fa37ece68af4863869b63ef040cd
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Xloader
Xloader is a rebranded version of Formbook malware.
-
Xloader Payload
-
Deletes itself
-
Suspicious use of SetThreadContext
-