General
-
Target
scm928192.rar
-
Size
202KB
-
Sample
210226-52ykymnq6a
-
MD5
a76a7a9f3c6900a31f0b7b54979cce76
-
SHA1
6ac6e07b9d620b542e599b53874934c62d673c28
-
SHA256
2f954a9ae45e4a7a0a1131f5ca55cd20da04b1416276897377e9490c428f691a
-
SHA512
e8ac6479026a005cfa49d78f1112bd280f897f910bb059a4fc879766c88036a8ba7074fc71da0f4cf71e41b07869b6eb31468f0e6c3ce14f698e6e0fe96aeb1c
Malware Config
Extracted
formbook
http://www.dopiel.com/s0ps/
vexura.com
xnl.xyz
lumpen.party
ourdatajourney.com
globalprofessionalsummit.com
wellnesspasssite.com
lafronteraradio.com
voterchallengeva.com
campanatv.com
militarychiro.com
cowbex.info
mosquitosolutionsalpha.com
healthykala.com
xmsealite.com
xn--ock1cjz.com
advocate-quota.com
karecfo.com
vettedwealthmanagement.com
everlein.com
lashundaclaiborn.com
Targets
-
-
Target
scm928192.exe
-
Size
237KB
-
MD5
ea2aaf3a9a00cab64376035e9291c7cc
-
SHA1
28683f918a9c4195ff93ca2027642949444770c0
-
SHA256
7bd662ff22dd43bb8e23046925d83ae5125824776c6b4209cc50417205c91e6c
-
SHA512
aa50e615fb57b3ce1963b8cbdf1b561c15f72bef210e4f80e4854a98ecd4915c32636b139637c0d36b4b00e1cfbdd57418b5e2891916fb1ccc2d5ba167b4ca1d
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Xloader
Xloader is a rebranded version of Formbook malware.
-
Xloader Payload
-
Suspicious use of SetThreadContext
-