General
-
Target
VCS58GQMhuCYghC.exe
-
Size
937KB
-
Sample
210119-mjf4a3y5w6
-
MD5
e36cffd41bac0837943e65c6e96d8f82
-
SHA1
048bdd4d332b56b10b7505800b4a869d91b4670e
-
SHA256
33f302f22ca7cfa4de06befaab200c53337b218196a9ef16ff6139d7f09a9b87
-
SHA512
7c87990fd8cc633280a85d7ab81e6a24edc89053ec58400eb5b0444276540cd4d21ce518086da8dca86fa1febf969f284dd037877ff29f357226fb25a7701dfb
Malware Config
Extracted
formbook
http://www.allismd.com/ur06/
philippebrooksdesign.com
cmoorestudio.com
profille-sarina23tammara.club
dqulxe.com
uiffinger.com
nolarapper.com
maconanimalexterminator.com
bisovka.com
loveisloveent.com
datication.com
spxo66.com
drhelpnow.com
ladybug-cle.com
macocome.com
thepoppysocks.com
eldritchparadox.com
mercadolibre.company
ismartfarm.com
kansascarlot.com
kevinld.com
Targets
-
-
Target
VCS58GQMhuCYghC.exe
-
Size
937KB
-
MD5
e36cffd41bac0837943e65c6e96d8f82
-
SHA1
048bdd4d332b56b10b7505800b4a869d91b4670e
-
SHA256
33f302f22ca7cfa4de06befaab200c53337b218196a9ef16ff6139d7f09a9b87
-
SHA512
7c87990fd8cc633280a85d7ab81e6a24edc89053ec58400eb5b0444276540cd4d21ce518086da8dca86fa1febf969f284dd037877ff29f357226fb25a7701dfb
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Xloader
Xloader is a rebranded version of Formbook malware.
-
Xloader Payload
-
Suspicious use of SetThreadContext
-