General
-
Target
SHEXD2101127S_ShippingDocument_DkD.xlsx
-
Size
1.6MB
-
Sample
210118-5na2ejmes6
-
MD5
321ec69aefdedc184ab2b86fde9d6b9a
-
SHA1
5fd74e6732d91f2984eaed33536c8a2f847aa41d
-
SHA256
5e3ef4890525eed5cb32b6bb1f90bcfc57932157b2a2abc349a6d2dfb2a8cb05
-
SHA512
d51ea1cdf634ca2b871cc3f792048bb0c18e1f6c0115aa2c44a6ce4ea3083fce5050ff6a614ba790cb2221564d1a8e6c099d70fe43b3d8bf4e5d11e49cd7b254
Malware Config
Extracted
formbook
http://www.stonescapes1.com/de92/
zindaginews.com
tyelevator.com
schustermaninterests.com
algemixdelchef.com
doubscollectivites.com
e-butchery.com
hellbentmask.com
jumbpprivacy.com
teeniestiedye.com
playfulartwork.com
desertvacahs.com
w5470-hed.net
nepalearningpods.com
smoothandsleek.com
thecannaglow.com
torrentkittyla.com
industrytoyou.com
raquelvargas.net
rlc-nc.net
cryptoprises.com
Targets
-
-
Target
SHEXD2101127S_ShippingDocument_DkD.xlsx
-
Size
1.6MB
-
MD5
321ec69aefdedc184ab2b86fde9d6b9a
-
SHA1
5fd74e6732d91f2984eaed33536c8a2f847aa41d
-
SHA256
5e3ef4890525eed5cb32b6bb1f90bcfc57932157b2a2abc349a6d2dfb2a8cb05
-
SHA512
d51ea1cdf634ca2b871cc3f792048bb0c18e1f6c0115aa2c44a6ce4ea3083fce5050ff6a614ba790cb2221564d1a8e6c099d70fe43b3d8bf4e5d11e49cd7b254
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Xloader
Xloader is a rebranded version of Formbook malware.
-
Xloader Payload
-
Blocklisted process makes network request
-
Executes dropped EXE
-
Loads dropped DLL
-
Uses the VBS compiler for execution
-
Suspicious use of SetThreadContext
-