General
-
Target
SHEXD2101127S_ShippingDocument_DkD.xlsx
-
Size
1.6MB
-
Sample
210118-cg42mzbra6
-
MD5
8323328ee54a8d0afd9e421a556a57b7
-
SHA1
836ff26907fc87551205ccf178b1f4bc7a3486df
-
SHA256
b34c09bf9e0459b2a09c73eb3f1c43d87861c64bbbbe26e59bfc243ef589f720
-
SHA512
a9013d2c4a2842fbbab254c78c8698df13f1466a677aa9a447380ef53a81962f4f83c6779d4cf07bf1de16c03b32192fed1838a40bf5dd29505905b2ca5bb370
Malware Config
Extracted
formbook
http://www.stonescapes1.com/de92/
zindaginews.com
tyelevator.com
schustermaninterests.com
algemixdelchef.com
doubscollectivites.com
e-butchery.com
hellbentmask.com
jumbpprivacy.com
teeniestiedye.com
playfulartwork.com
desertvacahs.com
w5470-hed.net
nepalearningpods.com
smoothandsleek.com
thecannaglow.com
torrentkittyla.com
industrytoyou.com
raquelvargas.net
rlc-nc.net
cryptoprises.com
Targets
-
-
Target
SHEXD2101127S_ShippingDocument_DkD.xlsx
-
Size
1.6MB
-
MD5
8323328ee54a8d0afd9e421a556a57b7
-
SHA1
836ff26907fc87551205ccf178b1f4bc7a3486df
-
SHA256
b34c09bf9e0459b2a09c73eb3f1c43d87861c64bbbbe26e59bfc243ef589f720
-
SHA512
a9013d2c4a2842fbbab254c78c8698df13f1466a677aa9a447380ef53a81962f4f83c6779d4cf07bf1de16c03b32192fed1838a40bf5dd29505905b2ca5bb370
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Xloader
Xloader is a rebranded version of Formbook malware.
-
Xloader Payload
-
Blocklisted process makes network request
-
Executes dropped EXE
-
Loads dropped DLL
-
Uses the VBS compiler for execution
-
Suspicious use of SetThreadContext
-