General
-
Target
Sales Contract_20210113.xlsx
-
Size
2.5MB
-
Sample
210121-7j9cvrxzx2
-
MD5
0f8e4207a331889d19817d8e8247675f
-
SHA1
511802fe1c7de26e967dabdad2c112cd4821efdf
-
SHA256
ef0235316487e8e59c6cb14d5f8c5bcc7cdcf85a5f6cfeef6a7a999c057dc499
-
SHA512
270c4250f3f7eb88dd0f05b9f56caf17cff4c9a256fff895213adfcafb7b684fd725afe11e67b68e02c007dcaace3ab7ebc56f70ef0997853bd08b046e102f96
Malware Config
Extracted
formbook
http://www.inreachpt.com/gqx2/
calusaptamiami.com
starlinkwebservices.com
lakeviewbarbershonola.com
oaklandraidersjerseyspop.com
ohiotechreport.com
eligetucafetera.com
tu4343.com
abstract-elearning.com
thebabylashes.com
athleteshive.com
fanninhomesforless.com
sembracna.com
servicesyn.com
bellairechoice.com
tmpaas.com
eyepaa.com
stickerzblvd.com
rentfs.com
nadya-shanab.com
microwgreens.net
Targets
-
-
Target
Sales Contract_20210113.xlsx
-
Size
2.5MB
-
MD5
0f8e4207a331889d19817d8e8247675f
-
SHA1
511802fe1c7de26e967dabdad2c112cd4821efdf
-
SHA256
ef0235316487e8e59c6cb14d5f8c5bcc7cdcf85a5f6cfeef6a7a999c057dc499
-
SHA512
270c4250f3f7eb88dd0f05b9f56caf17cff4c9a256fff895213adfcafb7b684fd725afe11e67b68e02c007dcaace3ab7ebc56f70ef0997853bd08b046e102f96
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Xloader
Xloader is a rebranded version of Formbook malware.
-
Xloader Payload
-
Blocklisted process makes network request
-
Executes dropped EXE
-
Loads dropped DLL
-
Uses the VBS compiler for execution
-
Enumerates physical storage devices
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of SetThreadContext
-