General
-
Target
SecuriteInfo.com.BehavesLike.Win32.Trojan.dc.925
-
Size
276KB
-
Sample
210119-a5vplj26ej
-
MD5
4755bdfa1fb87c626856b33c48419201
-
SHA1
c174cf847aa3e0a06128626c13608a3a5421e0f4
-
SHA256
d81f4b6a0b8650415e2c2acfe4ee223f6826b3b6849393f4de2db4f3a814beaf
-
SHA512
d7e982eb367ee0813dcdb92604f3f444c88603dc1aa6c5c14d397d7a43dfbedc7ee9280b3674a8715c4cab8c24176f4efa24d5cf206596b5e21cdc40c467c5ca
Malware Config
Extracted
formbook
http://www.hitchhikerfab.com/qjnt/
silverlakesfootball.com
drivebymovie.com
precisedirections.com
xn--01-mlcpq1abi.xn--p1acf
landhubturkey.com
andronomicon.com
kindlyhomecare.com
tyequip.com
planfra.com
wy1197.com
blackcatbaker.com
ddhhynjy.com
sales-altigen.com
valerielimozin.com
walmamall.com
quishkambalito.com
gnbsuvm.icu
milanostorear.com
olympiaopen.com
zradydlyazhinok-ua.com
Targets
-
-
Target
SecuriteInfo.com.BehavesLike.Win32.Trojan.dc.925
-
Size
276KB
-
MD5
4755bdfa1fb87c626856b33c48419201
-
SHA1
c174cf847aa3e0a06128626c13608a3a5421e0f4
-
SHA256
d81f4b6a0b8650415e2c2acfe4ee223f6826b3b6849393f4de2db4f3a814beaf
-
SHA512
d7e982eb367ee0813dcdb92604f3f444c88603dc1aa6c5c14d397d7a43dfbedc7ee9280b3674a8715c4cab8c24176f4efa24d5cf206596b5e21cdc40c467c5ca
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Xloader
Xloader is a rebranded version of Formbook malware.
-
Xloader Payload
-
Suspicious use of SetThreadContext
-