General
-
Target
Statement Of Account.exe
-
Size
893KB
-
Sample
210119-8bk1rdnk2s
-
MD5
436bfad859d57c0546982a3abf01e069
-
SHA1
bf2362cc3d66a764cc844ae17d820ae2f330abdc
-
SHA256
9763034a6f6e93c907471ca361e619f5fe5ec0b3aeb301cd046bd877c62aaea7
-
SHA512
26411a26de168fbc0dd5db590679570b77daf0ccb6fe8aafc8340bae8488a515a710dcc0234ff7ee23fa158df68d43353afaf20fc401cfc977ccbd30dc1036d4
Malware Config
Extracted
formbook
http://www.elridgeandandrea.com/sz0m/
wttmetroethernet.com
ybeautyinc.com
blackswan-ai.com
elitebettingnews.com
marialangarica.com
ra1nshot.space
sdkunlei.com
lingkarindonesia.com
acceptcreditcardaz.com
yantaifootball.com
checkmysocialcreditscore.com
masjovemestanoite.com
brandtalkspodcast.com
moneymethod.xyz
77js222.com
fuyang3.com
ptypty.com
entre-puneur.com
yes8168.com
lightuniverse-ity.com
Targets
-
-
Target
Statement Of Account.exe
-
Size
893KB
-
MD5
436bfad859d57c0546982a3abf01e069
-
SHA1
bf2362cc3d66a764cc844ae17d820ae2f330abdc
-
SHA256
9763034a6f6e93c907471ca361e619f5fe5ec0b3aeb301cd046bd877c62aaea7
-
SHA512
26411a26de168fbc0dd5db590679570b77daf0ccb6fe8aafc8340bae8488a515a710dcc0234ff7ee23fa158df68d43353afaf20fc401cfc977ccbd30dc1036d4
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Xloader
Xloader is a rebranded version of Formbook malware.
-
Xloader Payload
-
Deletes itself
-
Suspicious use of SetThreadContext
-