General
-
Target
5YfNeXk1f0wrxXm.exe
-
Size
353KB
-
Sample
210116-h8kpfm5lzs
-
MD5
a6af527f30950267d700bbc88817cc3a
-
SHA1
c72623f2a24529ae9563f8b0d5a3d5171c1a8537
-
SHA256
8b8fbe6805c361f5b04a198e8549a9797233faf4b9039004ebab000de593608d
-
SHA512
5b0bbb647f4df6d14188c846947a5d0ba0da99dc8e85491c682f615a4c973dd79302c004549ed9bc3b073f8265de46e6758ffa6e60d643409c79b1bbc3d7aa50
Malware Config
Extracted
formbook
http://www.allismd.com/ur06/
philippebrooksdesign.com
cmoorestudio.com
profille-sarina23tammara.club
dqulxe.com
uiffinger.com
nolarapper.com
maconanimalexterminator.com
bisovka.com
loveisloveent.com
datication.com
spxo66.com
drhelpnow.com
ladybug-cle.com
macocome.com
thepoppysocks.com
eldritchparadox.com
mercadolibre.company
ismartfarm.com
kansascarlot.com
kevinld.com
Targets
-
-
Target
5YfNeXk1f0wrxXm.exe
-
Size
353KB
-
MD5
a6af527f30950267d700bbc88817cc3a
-
SHA1
c72623f2a24529ae9563f8b0d5a3d5171c1a8537
-
SHA256
8b8fbe6805c361f5b04a198e8549a9797233faf4b9039004ebab000de593608d
-
SHA512
5b0bbb647f4df6d14188c846947a5d0ba0da99dc8e85491c682f615a4c973dd79302c004549ed9bc3b073f8265de46e6758ffa6e60d643409c79b1bbc3d7aa50
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Xloader
Xloader is a rebranded version of Formbook malware.
-
Xloader Payload
-
Deletes itself
-
Suspicious use of SetThreadContext
-