General
-
Target
2d6580e78be6580bf89ed5e9e13f14e0.exe
-
Size
1.4MB
-
Sample
210119-pbgaqed4n2
-
MD5
2d6580e78be6580bf89ed5e9e13f14e0
-
SHA1
3f5153f7da3338d61164df6944b01a0666396517
-
SHA256
a38cbbb16b9dda3d7aebcdcd033a8f5e56f17257c060859a3cdd2e1a8bb27ab9
-
SHA512
c58a9f97990e255afd7b6f5538a95d132e0ad00d204b6f3de32e1d675a45d99397e098fe9515081d13eb9ba3491d8cea294f19c7392563212549fc8a739a37bb
Malware Config
Extracted
formbook
http://www.inreachpt.com/gqx2/
calusaptamiami.com
starlinkwebservices.com
lakeviewbarbershonola.com
oaklandraidersjerseyspop.com
ohiotechreport.com
eligetucafetera.com
tu4343.com
abstract-elearning.com
thebabylashes.com
athleteshive.com
fanninhomesforless.com
sembracna.com
servicesyn.com
bellairechoice.com
tmpaas.com
eyepaa.com
stickerzblvd.com
rentfs.com
nadya-shanab.com
microwgreens.net
Targets
-
-
Target
2d6580e78be6580bf89ed5e9e13f14e0.exe
-
Size
1.4MB
-
MD5
2d6580e78be6580bf89ed5e9e13f14e0
-
SHA1
3f5153f7da3338d61164df6944b01a0666396517
-
SHA256
a38cbbb16b9dda3d7aebcdcd033a8f5e56f17257c060859a3cdd2e1a8bb27ab9
-
SHA512
c58a9f97990e255afd7b6f5538a95d132e0ad00d204b6f3de32e1d675a45d99397e098fe9515081d13eb9ba3491d8cea294f19c7392563212549fc8a739a37bb
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Xloader
Xloader is a rebranded version of Formbook malware.
-
Xloader Payload
-
Suspicious use of SetThreadContext
-