General
-
Target
f1b06407f8fe5e17a2bca06f7c7d54711f41df69163f3e9027c7521c0b17a864
-
Size
337KB
-
Sample
220302-x2yhhsgae4
-
MD5
d6cb6f4304865dcfc312a32d1f2e7880
-
SHA1
e96f64cec39d44a820d637bdd522d3a8e71d854f
-
SHA256
f1b06407f8fe5e17a2bca06f7c7d54711f41df69163f3e9027c7521c0b17a864
-
SHA512
948569df69e08ab6cc8e01dcb0301aa40a9832d96b350d13e2bfd84ec56f66f401ce902f7c3774bee0b371a345804b3607eea6047d53ffd979a448acd4a1730c
Malware Config
Extracted
xloader
2.5
p2a5
gorillaslovebananas.com
zonaextasis.com
digitalpravin.online
memorialdoors.com
departmenteindhoven.com
vipulb.com
ruyibao365.com
ynpzz.com
matthewandjessica.com
winfrey2024.com
janetride.com
arairazur.xyz
alltheheads.com
amayawebdesigns.com
califunder.com
blacksource.xyz
farmasi.agency
ilmkibahar.com
thinkcentury.net
eskortclub.com
Targets
-
-
Target
f1b06407f8fe5e17a2bca06f7c7d54711f41df69163f3e9027c7521c0b17a864
-
Size
337KB
-
MD5
d6cb6f4304865dcfc312a32d1f2e7880
-
SHA1
e96f64cec39d44a820d637bdd522d3a8e71d854f
-
SHA256
f1b06407f8fe5e17a2bca06f7c7d54711f41df69163f3e9027c7521c0b17a864
-
SHA512
948569df69e08ab6cc8e01dcb0301aa40a9832d96b350d13e2bfd84ec56f66f401ce902f7c3774bee0b371a345804b3607eea6047d53ffd979a448acd4a1730c
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Xloader
Xloader is a rebranded version of Formbook malware.
-
Xloader Payload
-
Executes dropped EXE
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-