General
-
Target
NEW AGREEMENT 19 01 2021.xlsx
-
Size
2.2MB
-
Sample
210119-rkap7aq29s
-
MD5
54e7a0d10b951a9644ac392523a65fe8
-
SHA1
81906d0f4da1f87b9873d5f4b198c83bb88f4789
-
SHA256
99cadef901a24aecf640895bb97378b6202ca0e625ba63951aea1a1e87b7209b
-
SHA512
05615570d0bdfea44a49e095b4826507eadb508b1ded0a6abcbb6e15b891e990bd0bc205459bd213780d56a20f59ffcbed6a1fbacdd2e755da5f74d158013f48
Malware Config
Extracted
formbook
http://www.rizrvd.com/bw82/
fundamentaliemef.com
gallerybrows.com
leadeligey.com
octoberx2.online
climaxnovels.com
gdsjgf.com
curateherstories.com
blacksailus.com
yjpps.com
gmobilet.com
fcoins.club
foreverlive2027.com
healthyfifties.com
wmarquezy.com
housebulb.com
thebabyfriendly.com
primajayaintiperkasa.com
learnplaychess.com
chrisbubser.digital
xn--avenr-wsa.com
Targets
-
-
Target
NEW AGREEMENT 19 01 2021.xlsx
-
Size
2.2MB
-
MD5
54e7a0d10b951a9644ac392523a65fe8
-
SHA1
81906d0f4da1f87b9873d5f4b198c83bb88f4789
-
SHA256
99cadef901a24aecf640895bb97378b6202ca0e625ba63951aea1a1e87b7209b
-
SHA512
05615570d0bdfea44a49e095b4826507eadb508b1ded0a6abcbb6e15b891e990bd0bc205459bd213780d56a20f59ffcbed6a1fbacdd2e755da5f74d158013f48
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Xloader
Xloader is a rebranded version of Formbook malware.
-
Xloader Payload
-
Blocklisted process makes network request
-
Executes dropped EXE
-
Loads dropped DLL
-
Uses the VBS compiler for execution
-
Suspicious use of SetThreadContext
-