General
-
Target
dira2.exe
-
Size
914KB
-
Sample
210120-3zt81wmvc6
-
MD5
7f67485d2d0a280dce0e66d24fa97972
-
SHA1
508369a537e7db8b44505f2d2d55f57ddefad947
-
SHA256
1e0ffffac4a1077450af5cd08414d45c275605cdedd7a3138a863b96ea3624ab
-
SHA512
f614fc558d676510958a64dd2c83edd280dce713a28e3276b3d840f20b39a816e4175d5cd53e4830cf36c425cb3d2951f63e19b977d889c22b5a7a3a34b7e2f3
Malware Config
Extracted
formbook
http://www.rizrvd.com/bw82/
fundamentaliemef.com
gallerybrows.com
leadeligey.com
octoberx2.online
climaxnovels.com
gdsjgf.com
curateherstories.com
blacksailus.com
yjpps.com
gmobilet.com
fcoins.club
foreverlive2027.com
healthyfifties.com
wmarquezy.com
housebulb.com
thebabyfriendly.com
primajayaintiperkasa.com
learnplaychess.com
chrisbubser.digital
xn--avenr-wsa.com
Targets
-
-
Target
dira2.exe
-
Size
914KB
-
MD5
7f67485d2d0a280dce0e66d24fa97972
-
SHA1
508369a537e7db8b44505f2d2d55f57ddefad947
-
SHA256
1e0ffffac4a1077450af5cd08414d45c275605cdedd7a3138a863b96ea3624ab
-
SHA512
f614fc558d676510958a64dd2c83edd280dce713a28e3276b3d840f20b39a816e4175d5cd53e4830cf36c425cb3d2951f63e19b977d889c22b5a7a3a34b7e2f3
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Xloader
Xloader is a rebranded version of Formbook malware.
-
Xloader Payload
-
Deletes itself
-
Suspicious use of SetThreadContext
-