General
-
Target
1efbf83ad79b5ad5da0a0d7ef978f070.exe
-
Size
1002KB
-
Sample
210115-rafdfxl6ds
-
MD5
1efbf83ad79b5ad5da0a0d7ef978f070
-
SHA1
886fe81b645e2eeb2a17324dc867191a538e39e6
-
SHA256
67a6d88adc9c1a810565231bdc4eb66ca19e8525fcefb6f99035721bcfa1b537
-
SHA512
e0ae3bb9b1c232b5d4f5a8f1bfe6d1c840449ade316e055ba5528713bf4a27ba0204c10bbe9a4579eb17554a0b4d74e81ead42e18d7a9e500f057e8e6127ba68
Malware Config
Extracted
formbook
http://www.bodyfuelrtd.com/8rg4/
fakecostasunglasses.com
twinbrothers.pizza
jizhoujsp.com
qscrit.com
hotelmanise.com
fer-ua.online
europserver-simcloud.systems
redwap2.pro
betwalkoffame.com
latashalovemillionaire.com
8million-lr.com
tomatrader.com
modaluxcutabovefitness.com
shishijiazu.com
cckytx.com
reversehomeloansmiami.com
imaginenationnetwork.com
thecyclistshop.com
jorgegiljewelry.com
hlaprotiens.com
Targets
-
-
Target
1efbf83ad79b5ad5da0a0d7ef978f070.exe
-
Size
1002KB
-
MD5
1efbf83ad79b5ad5da0a0d7ef978f070
-
SHA1
886fe81b645e2eeb2a17324dc867191a538e39e6
-
SHA256
67a6d88adc9c1a810565231bdc4eb66ca19e8525fcefb6f99035721bcfa1b537
-
SHA512
e0ae3bb9b1c232b5d4f5a8f1bfe6d1c840449ade316e055ba5528713bf4a27ba0204c10bbe9a4579eb17554a0b4d74e81ead42e18d7a9e500f057e8e6127ba68
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Xloader
Xloader is a rebranded version of Formbook malware.
-
Xloader Payload
-
Suspicious use of SetThreadContext
-