General
-
Target
Mv Maersk Kleven V949E.xlsx
-
Size
2.5MB
-
Sample
210120-ytce4sq1mx
-
MD5
6be3e9c02baf9a27b373828674734d1c
-
SHA1
6247f1532280688e47dec2391ae56f8d7fd6f009
-
SHA256
f452c7fcea80ab74948ddb9e2c3e46072d491b21309fbe690662112ef4e093ef
-
SHA512
8a2d9359b5378d0ba3f1a452b3b1958899e96e2be2049038636087f62e6ba380bf8d19edbd3c882e371e685587267a76a383a470d44f304c050be3cb998c513d
Malware Config
Extracted
formbook
http://www.learnhour.net/eaud/
modshiro.com
mademarketingoss.com
austinjourls.info
wayupteam.com
crossingfinger.com
interseptors.com
gigashit.com
livetigo.com
halamankuningindonesia.com
windhammills.com
aylinahmet.com
mbacexonan.website
shopboxbarcelona.com
youyeslive.com
coonlinesportsbooks.com
guorunme.com
putlocker2.site
pencueaidnetwork.com
likevector.com
vulcanudachi-proclub.com
Targets
-
-
Target
Mv Maersk Kleven V949E.xlsx
-
Size
2.5MB
-
MD5
6be3e9c02baf9a27b373828674734d1c
-
SHA1
6247f1532280688e47dec2391ae56f8d7fd6f009
-
SHA256
f452c7fcea80ab74948ddb9e2c3e46072d491b21309fbe690662112ef4e093ef
-
SHA512
8a2d9359b5378d0ba3f1a452b3b1958899e96e2be2049038636087f62e6ba380bf8d19edbd3c882e371e685587267a76a383a470d44f304c050be3cb998c513d
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Xloader
Xloader is a rebranded version of Formbook malware.
-
Xloader Payload
-
Blocklisted process makes network request
-
Executes dropped EXE
-
Loads dropped DLL
-
Uses the VBS compiler for execution
-
Enumerates physical storage devices
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of SetThreadContext
-