General
-
Target
5c0942487820e14219794f029a64e1fe.exe
-
Size
872KB
-
Sample
210119-1x5yw67vz6
-
MD5
5c0942487820e14219794f029a64e1fe
-
SHA1
40b9b174db8a89f4c81f5ad66f6528f1bd9e8efb
-
SHA256
f991818096935708b00e812a9700a0215a1583047f2721552a9d6375abf0db75
-
SHA512
0cb1095c2349389b3aab75451cde102008771e8bb42565534501afc4c838193b834ad97e72f380d491bdded84075ce9fecd58b34b37ebd29751958aac9497849
Malware Config
Extracted
formbook
http://www.kaiyuansu.pro/incn/
1bovvfk93jd.com
enlightenedhealthcoaching.com
findthatsmartphone.com
intelligentsystemsus.com
xn--lmsealamientos-tnb.com
eot0luh5ia.men
babanewshop.com
beyond-bit.com
meritane.com
buythinsecret.com
c2ornot.com
twelvesband.com
rktlends.com
bourseandish.com
happyshop88.com
topangacanyonvintage.com
epersonalloansonline.com
roofers-anaheim.com
shanghaiys.net
bickel.wtf
Targets
-
-
Target
5c0942487820e14219794f029a64e1fe.exe
-
Size
872KB
-
MD5
5c0942487820e14219794f029a64e1fe
-
SHA1
40b9b174db8a89f4c81f5ad66f6528f1bd9e8efb
-
SHA256
f991818096935708b00e812a9700a0215a1583047f2721552a9d6375abf0db75
-
SHA512
0cb1095c2349389b3aab75451cde102008771e8bb42565534501afc4c838193b834ad97e72f380d491bdded84075ce9fecd58b34b37ebd29751958aac9497849
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Xloader
Xloader is a rebranded version of Formbook malware.
-
Xloader Payload
-
Suspicious use of SetThreadContext
-