General
-
Target
d4ecd2bd3d00a12dffcf55e006eb7b24.exe
-
Size
1.0MB
-
Sample
210119-ljmsly8wje
-
MD5
d4ecd2bd3d00a12dffcf55e006eb7b24
-
SHA1
99b1322240a29fc6497493c903d179c55676c613
-
SHA256
750292519a4b694e981556bdaec9c5b568ac54f1b9cb52fc1f740cd45b2748ec
-
SHA512
31e79736b401f0434f1c71d7694e28989fb5881ad25673abe4893ae1d116a35e5316471d4fc6f96a4f8cd2b23075b3e437139c8e538e3849d8afafc9199ab546
Malware Config
Extracted
formbook
http://www.rizrvd.com/bw82/
fundamentaliemef.com
gallerybrows.com
leadeligey.com
octoberx2.online
climaxnovels.com
gdsjgf.com
curateherstories.com
blacksailus.com
yjpps.com
gmobilet.com
fcoins.club
foreverlive2027.com
healthyfifties.com
wmarquezy.com
housebulb.com
thebabyfriendly.com
primajayaintiperkasa.com
learnplaychess.com
chrisbubser.digital
xn--avenr-wsa.com
Targets
-
-
Target
d4ecd2bd3d00a12dffcf55e006eb7b24.exe
-
Size
1.0MB
-
MD5
d4ecd2bd3d00a12dffcf55e006eb7b24
-
SHA1
99b1322240a29fc6497493c903d179c55676c613
-
SHA256
750292519a4b694e981556bdaec9c5b568ac54f1b9cb52fc1f740cd45b2748ec
-
SHA512
31e79736b401f0434f1c71d7694e28989fb5881ad25673abe4893ae1d116a35e5316471d4fc6f96a4f8cd2b23075b3e437139c8e538e3849d8afafc9199ab546
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Xloader
Xloader is a rebranded version of Formbook malware.
-
Xloader Payload
-
Suspicious use of SetThreadContext
-