General
-
Target
Shipping Documents.xlsx
-
Size
1.3MB
-
Sample
210115-xmtl1serna
-
MD5
ec88cfb5b30b39215078445c9a76cec9
-
SHA1
41eddb8bf0c03a15dda66911de98a8c011337c5a
-
SHA256
1d094beecd56ab33b6c148d46d32c8d0c9d628cd2008becb273565f1a7902649
-
SHA512
2c8d73ae64db127e305afabc93a18df9590a8b9205cfe5800c2604c781b887c7dfaacbeddb97397b815079f594d330eae31862e4e4eab5efc60e0aeaec93a96d
Malware Config
Extracted
formbook
http://www.learnhour.net/eaud/
modshiro.com
mademarketingoss.com
austinjourls.info
wayupteam.com
crossingfinger.com
interseptors.com
gigashit.com
livetigo.com
halamankuningindonesia.com
windhammills.com
aylinahmet.com
mbacexonan.website
shopboxbarcelona.com
youyeslive.com
coonlinesportsbooks.com
guorunme.com
putlocker2.site
pencueaidnetwork.com
likevector.com
vulcanudachi-proclub.com
Targets
-
-
Target
Shipping Documents.xlsx
-
Size
1.3MB
-
MD5
ec88cfb5b30b39215078445c9a76cec9
-
SHA1
41eddb8bf0c03a15dda66911de98a8c011337c5a
-
SHA256
1d094beecd56ab33b6c148d46d32c8d0c9d628cd2008becb273565f1a7902649
-
SHA512
2c8d73ae64db127e305afabc93a18df9590a8b9205cfe5800c2604c781b887c7dfaacbeddb97397b815079f594d330eae31862e4e4eab5efc60e0aeaec93a96d
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Xloader
Xloader is a rebranded version of Formbook malware.
-
Xloader Payload
-
Blocklisted process makes network request
-
Executes dropped EXE
-
Loads dropped DLL
-
Uses the VBS compiler for execution
-
Suspicious use of SetThreadContext
-