General
-
Target
3KvCNpcQ6tvwKr5.exe
-
Size
894KB
-
Sample
210119-3f5gy3nxq2
-
MD5
03c67a5a09e3a472b5ac1db3e64f36dd
-
SHA1
ed818f401e5d67f1351fd94d121c0a64739bcba9
-
SHA256
f1422701954b6c0116802819526ba75f414beda5419f80445d321885d8732473
-
SHA512
6d7279cfc5a9e68c1f8c9aa39d4f2208487a42bbd967337a25611513efcf10e1dd7d27a04aeae84bd1a131c068b5d5f2a121bdadbed94927bd590a8bf35412a9
Malware Config
Extracted
formbook
http://www.allismd.com/ur06/
philippebrooksdesign.com
cmoorestudio.com
profille-sarina23tammara.club
dqulxe.com
uiffinger.com
nolarapper.com
maconanimalexterminator.com
bisovka.com
loveisloveent.com
datication.com
spxo66.com
drhelpnow.com
ladybug-cle.com
macocome.com
thepoppysocks.com
eldritchparadox.com
mercadolibre.company
ismartfarm.com
kansascarlot.com
kevinld.com
Targets
-
-
Target
3KvCNpcQ6tvwKr5.exe
-
Size
894KB
-
MD5
03c67a5a09e3a472b5ac1db3e64f36dd
-
SHA1
ed818f401e5d67f1351fd94d121c0a64739bcba9
-
SHA256
f1422701954b6c0116802819526ba75f414beda5419f80445d321885d8732473
-
SHA512
6d7279cfc5a9e68c1f8c9aa39d4f2208487a42bbd967337a25611513efcf10e1dd7d27a04aeae84bd1a131c068b5d5f2a121bdadbed94927bd590a8bf35412a9
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Xloader
Xloader is a rebranded version of Formbook malware.
-
Xloader Payload
-
Deletes itself
-
Suspicious use of SetThreadContext
-