General
-
Target
Purchase_Order_4501470158_request_for_quatation_09488588.exe
-
Size
937KB
-
Sample
210118-blqlxmwdyn
-
MD5
0ef28ea7498111382b1830d2f0e0f3b8
-
SHA1
9d7227efbfdc8f3340ccb7caf36ba48abd1f33ed
-
SHA256
518023c16668547a3d37cd93ca34ae6697364dd838c8538d6de80441f2b6c1bd
-
SHA512
4e01be4a974b894a4efba8cc00430b3aa536ad544db07e4833d90cac877779c4763d71adaccc35f286d94c60a670436973e6f4925b7b21bdc8049910a161620c
Malware Config
Extracted
formbook
http://www.bodyfuelrtd.com/8rg4/
fakecostasunglasses.com
twinbrothers.pizza
jizhoujsp.com
qscrit.com
hotelmanise.com
fer-ua.online
europserver-simcloud.systems
redwap2.pro
betwalkoffame.com
latashalovemillionaire.com
8million-lr.com
tomatrader.com
modaluxcutabovefitness.com
shishijiazu.com
cckytx.com
reversehomeloansmiami.com
imaginenationnetwork.com
thecyclistshop.com
jorgegiljewelry.com
hlaprotiens.com
Targets
-
-
Target
Purchase_Order_4501470158_request_for_quatation_09488588.exe
-
Size
937KB
-
MD5
0ef28ea7498111382b1830d2f0e0f3b8
-
SHA1
9d7227efbfdc8f3340ccb7caf36ba48abd1f33ed
-
SHA256
518023c16668547a3d37cd93ca34ae6697364dd838c8538d6de80441f2b6c1bd
-
SHA512
4e01be4a974b894a4efba8cc00430b3aa536ad544db07e4833d90cac877779c4763d71adaccc35f286d94c60a670436973e6f4925b7b21bdc8049910a161620c
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Xloader
Xloader is a rebranded version of Formbook malware.
-
Xloader Payload
-
Suspicious use of SetThreadContext
-