General
-
Target
1c68b56f273eab047eccce3cbad492a5.exe
-
Size
885KB
-
Sample
210118-h2qa89cgbe
-
MD5
1c68b56f273eab047eccce3cbad492a5
-
SHA1
76598e8315496d2bfcaa35edd12f521483ff5c31
-
SHA256
6961aeab02e7dafda1e2f16e9ec88fd5dce6199925a71f22657a2c48627ae087
-
SHA512
7f24e6f61a86314e91275d4492b74659ca34f036fb32c20eccaebd68410a228dae3d1bca2f6faa74933692b50a19aca693b3c5ca803c3717175e19b58d1ba6e6
Malware Config
Extracted
formbook
http://www.kaiyuansu.pro/incn/
1bovvfk93jd.com
enlightenedhealthcoaching.com
findthatsmartphone.com
intelligentsystemsus.com
xn--lmsealamientos-tnb.com
eot0luh5ia.men
babanewshop.com
beyond-bit.com
meritane.com
buythinsecret.com
c2ornot.com
twelvesband.com
rktlends.com
bourseandish.com
happyshop88.com
topangacanyonvintage.com
epersonalloansonline.com
roofers-anaheim.com
shanghaiys.net
bickel.wtf
Targets
-
-
Target
1c68b56f273eab047eccce3cbad492a5.exe
-
Size
885KB
-
MD5
1c68b56f273eab047eccce3cbad492a5
-
SHA1
76598e8315496d2bfcaa35edd12f521483ff5c31
-
SHA256
6961aeab02e7dafda1e2f16e9ec88fd5dce6199925a71f22657a2c48627ae087
-
SHA512
7f24e6f61a86314e91275d4492b74659ca34f036fb32c20eccaebd68410a228dae3d1bca2f6faa74933692b50a19aca693b3c5ca803c3717175e19b58d1ba6e6
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Xloader
Xloader is a rebranded version of Formbook malware.
-
Xloader Payload
-
Suspicious use of SetThreadContext
-