General
-
Target
FHT210995.exe
-
Size
350KB
-
Sample
210119-t96wemxf6e
-
MD5
c8f1dc4896822a9c3bbfbd1880f4fc1b
-
SHA1
41f803431c6a5dcc062a8c8cf8ba80e90a09f717
-
SHA256
c2aa09fda8ed6089db384994dc58fe814ff5a725ea05cd1ccca910b0d901301a
-
SHA512
dcdaacdbb766d976750ce7053b271292169263bc4deb4f49189e365f475695ece10ad63955acb526db754b5b6ab08573e8be5ce4d42ada1e7834ea5a3b3a4f75
Malware Config
Extracted
formbook
http://www.tzmm.net/wpsb/
0817ls.com
drawbeirut.com
respiteready.com
yufkayurek.com
poss-plus.com
distributesimilar.com
mcmendzlawns.com
bingent.info
wellnessandcomfort.com
humilityhope.com
recetasfes.com
olala.asia
epochryphal.com
room-lettings-onlines.club
lvc.xyz
reicolee.com
davidmarkphotovideo.photography
corpuschristicarbuyers.com
tutorialyoutube.com
ativ.pro
Targets
-
-
Target
FHT210995.exe
-
Size
350KB
-
MD5
c8f1dc4896822a9c3bbfbd1880f4fc1b
-
SHA1
41f803431c6a5dcc062a8c8cf8ba80e90a09f717
-
SHA256
c2aa09fda8ed6089db384994dc58fe814ff5a725ea05cd1ccca910b0d901301a
-
SHA512
dcdaacdbb766d976750ce7053b271292169263bc4deb4f49189e365f475695ece10ad63955acb526db754b5b6ab08573e8be5ce4d42ada1e7834ea5a3b3a4f75
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Xloader
Xloader is a rebranded version of Formbook malware.
-
Xloader Payload
-
Deletes itself
-
Suspicious use of SetThreadContext
-