General
-
Target
Shipping Documents PL&BL Draft.scr
-
Size
449KB
-
Sample
210117-fxwmewalja
-
MD5
683ec5541b3901533bf82d5df00dcde2
-
SHA1
c3dc36ffb0efaf7aad512b8a82c43678b7314f38
-
SHA256
040e512b75bacd0ed6e0e13efa13f6ea92ebd47c214112b5371425009909c842
-
SHA512
f17861a053bb7646911aa3b9b67b5918c6cefd09a91e28cb11fd2a6d549f4e279ca345403e0e32f9ed6a3b15c29fb2a25a885b4bb845d42c8b8dbfad47165134
Malware Config
Extracted
formbook
http://www.elevatedenterprizes.com/h3qo/
dhflow.com
jyindex.com
ezcleanhandle.com
trungtamcongdong.online
simsprotectionagency.com
easylivemeet.com
blackvikingfashionhouse.com
52banxue.com
girlsinit.com
drhemo.com
freethefarmers.com
velvetrosephotography.com
geometricbotaniclas.com
skyandspirit.com
deltacomunicacao.com
mucademy.com
jaboilfieldsolutions.net
howtowinatblackjacknow.com
anytimegrowth.com
simranluthra.com
Targets
-
-
Target
Shipping Documents PL&BL Draft.scr
-
Size
449KB
-
MD5
683ec5541b3901533bf82d5df00dcde2
-
SHA1
c3dc36ffb0efaf7aad512b8a82c43678b7314f38
-
SHA256
040e512b75bacd0ed6e0e13efa13f6ea92ebd47c214112b5371425009909c842
-
SHA512
f17861a053bb7646911aa3b9b67b5918c6cefd09a91e28cb11fd2a6d549f4e279ca345403e0e32f9ed6a3b15c29fb2a25a885b4bb845d42c8b8dbfad47165134
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Xloader
Xloader is a rebranded version of Formbook malware.
-
Xloader Payload
-
Deletes itself
-
Suspicious use of SetThreadContext
-