General
-
Target
dir1.exe
-
Size
1.2MB
-
Sample
210118-vs3dgxcxva
-
MD5
20485bdf912a946e680b2237a0584190
-
SHA1
d070917962559bac8543d0a7875dd19d46a5739f
-
SHA256
a12d62cf3071c705c6527b3a640f6dfa3f4823cf5289f8be7cba25ac14e79031
-
SHA512
5a8bb98c44e051b7b5f0339d3a0bdf3be438100fa74aaab962276fbc1a4fa79ad0314c30bf6468948e3ac797bf8a4e96fcfa8535177cb1a446ff2553998606cb
Malware Config
Extracted
formbook
http://www.rizrvd.com/bw82/
fundamentaliemef.com
gallerybrows.com
leadeligey.com
octoberx2.online
climaxnovels.com
gdsjgf.com
curateherstories.com
blacksailus.com
yjpps.com
gmobilet.com
fcoins.club
foreverlive2027.com
healthyfifties.com
wmarquezy.com
housebulb.com
thebabyfriendly.com
primajayaintiperkasa.com
learnplaychess.com
chrisbubser.digital
xn--avenr-wsa.com
Targets
-
-
Target
dir1.exe
-
Size
1.2MB
-
MD5
20485bdf912a946e680b2237a0584190
-
SHA1
d070917962559bac8543d0a7875dd19d46a5739f
-
SHA256
a12d62cf3071c705c6527b3a640f6dfa3f4823cf5289f8be7cba25ac14e79031
-
SHA512
5a8bb98c44e051b7b5f0339d3a0bdf3be438100fa74aaab962276fbc1a4fa79ad0314c30bf6468948e3ac797bf8a4e96fcfa8535177cb1a446ff2553998606cb
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Xloader
Xloader is a rebranded version of Formbook malware.
-
Xloader Payload
-
Deletes itself
-
Suspicious use of SetThreadContext
-