General
-
Target
6297ab315894fb5a0d09be591490ef8b.exe
-
Size
1.4MB
-
Sample
210120-wyb7jqjpba
-
MD5
6297ab315894fb5a0d09be591490ef8b
-
SHA1
0106e386f58d515c5f3a010f73d3171a267a6298
-
SHA256
b95d2327a21e9c59261df7296f490ad524393475c00458e90567be63db226935
-
SHA512
070836843df29ab17ac605571c9a44e44aaefc9f8fc6815e6032e07a41735480fe242b86feab4e9017dae327c058c787265cf4a41aa51561bb8fdf485c4a1b1a
Malware Config
Extracted
formbook
http://www.bodyfuelrtd.com/8rg4/
fakecostasunglasses.com
twinbrothers.pizza
jizhoujsp.com
qscrit.com
hotelmanise.com
fer-ua.online
europserver-simcloud.systems
redwap2.pro
betwalkoffame.com
latashalovemillionaire.com
8million-lr.com
tomatrader.com
modaluxcutabovefitness.com
shishijiazu.com
cckytx.com
reversehomeloansmiami.com
imaginenationnetwork.com
thecyclistshop.com
jorgegiljewelry.com
hlaprotiens.com
Targets
-
-
Target
6297ab315894fb5a0d09be591490ef8b.exe
-
Size
1.4MB
-
MD5
6297ab315894fb5a0d09be591490ef8b
-
SHA1
0106e386f58d515c5f3a010f73d3171a267a6298
-
SHA256
b95d2327a21e9c59261df7296f490ad524393475c00458e90567be63db226935
-
SHA512
070836843df29ab17ac605571c9a44e44aaefc9f8fc6815e6032e07a41735480fe242b86feab4e9017dae327c058c787265cf4a41aa51561bb8fdf485c4a1b1a
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Xloader
Xloader is a rebranded version of Formbook malware.
-
Xloader Payload
-
Suspicious use of SetThreadContext
-