General
-
Target
Shipping Document PL&BL Draft.exe
-
Size
467KB
-
Sample
210118-1srnm2t4ee
-
MD5
dd56b21e6b3a1a0958885059d6a395d2
-
SHA1
01ba3635bb6776ef50ad57c206cf674d69e8e61c
-
SHA256
e7091e7da366f0b1d4acbc1295841c6f7d1ab9412a9fe3fd9341c9d94274c457
-
SHA512
dccf3a92be410b7a0f20342c73c2e935975eecf3bb23c3dac69aaa91ff4e944593c3f4cfd2dc8e751c9c042089028affa9bfbacc4474c5adc0b19622232ed1b5
Malware Config
Extracted
formbook
http://www.elevatedenterprizes.com/h3qo/
dhflow.com
jyindex.com
ezcleanhandle.com
trungtamcongdong.online
simsprotectionagency.com
easylivemeet.com
blackvikingfashionhouse.com
52banxue.com
girlsinit.com
drhemo.com
freethefarmers.com
velvetrosephotography.com
geometricbotaniclas.com
skyandspirit.com
deltacomunicacao.com
mucademy.com
jaboilfieldsolutions.net
howtowinatblackjacknow.com
anytimegrowth.com
simranluthra.com
Targets
-
-
Target
Shipping Document PL&BL Draft.exe
-
Size
467KB
-
MD5
dd56b21e6b3a1a0958885059d6a395d2
-
SHA1
01ba3635bb6776ef50ad57c206cf674d69e8e61c
-
SHA256
e7091e7da366f0b1d4acbc1295841c6f7d1ab9412a9fe3fd9341c9d94274c457
-
SHA512
dccf3a92be410b7a0f20342c73c2e935975eecf3bb23c3dac69aaa91ff4e944593c3f4cfd2dc8e751c9c042089028affa9bfbacc4474c5adc0b19622232ed1b5
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Xloader
Xloader is a rebranded version of Formbook malware.
-
Xloader Payload
-
Deletes itself
-
Suspicious use of SetThreadContext
-