General
-
Target
215fae8dcce9cd4d49b039770e17e418.exe
-
Size
1.0MB
-
Sample
210121-z7qqjtc4ej
-
MD5
215fae8dcce9cd4d49b039770e17e418
-
SHA1
9d656901f84e9e31c58e507dbd9d7163d7f08d3b
-
SHA256
3f761fad9b260d06c4b062814b5ea84a196ec7add1c942748f8651e3c0c8d732
-
SHA512
e7895cb87dd9792c8ca1be5ae331c0e443c9ecb01b684b8bed03d8c5043c362bc73044e5fc48880107fe257c7d34ad82c57750b517a8411693c721433c6761ec
Malware Config
Extracted
formbook
http://www.bodyfuelrtd.com/8rg4/
fakecostasunglasses.com
twinbrothers.pizza
jizhoujsp.com
qscrit.com
hotelmanise.com
fer-ua.online
europserver-simcloud.systems
redwap2.pro
betwalkoffame.com
latashalovemillionaire.com
8million-lr.com
tomatrader.com
modaluxcutabovefitness.com
shishijiazu.com
cckytx.com
reversehomeloansmiami.com
imaginenationnetwork.com
thecyclistshop.com
jorgegiljewelry.com
hlaprotiens.com
Targets
-
-
Target
215fae8dcce9cd4d49b039770e17e418.exe
-
Size
1.0MB
-
MD5
215fae8dcce9cd4d49b039770e17e418
-
SHA1
9d656901f84e9e31c58e507dbd9d7163d7f08d3b
-
SHA256
3f761fad9b260d06c4b062814b5ea84a196ec7add1c942748f8651e3c0c8d732
-
SHA512
e7895cb87dd9792c8ca1be5ae331c0e443c9ecb01b684b8bed03d8c5043c362bc73044e5fc48880107fe257c7d34ad82c57750b517a8411693c721433c6761ec
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Xloader
Xloader is a rebranded version of Formbook malware.
-
Xloader Payload
-
Suspicious use of SetThreadContext
-