General
-
Target
order.exe
-
Size
242KB
-
Sample
220411-hpnp8abbfr
-
MD5
1fca4a7a2a1bc5631ae3bed8065a9167
-
SHA1
631a8a37179b57365515e1b4741305d75928342e
-
SHA256
27331403cd4e737d09c723eaa8ad57607f4a243a1fcde752443af581b9141092
-
SHA512
ac4bc3e02782b8ac894caa2eb536eb193e460b011bdf4926649ac4416bbf96642a7aeaa0f60a5e739ea5d7553e411e8674f4399b5a6f0443070fe963ec8739a0
Malware Config
Extracted
xloader
2.5
cbgo
santesha.com
britneysbeautybar.com
sh-cy17.com
jeffcarveragency.com
3117111.com
sobrehosting.net
ddm123.xyz
toxcompliance.com
auditorydesigns.com
vliftfacial.com
ielhii.com
naameliss.com
ritualchariot.com
solchange.com
quatre-vingts.design
lawnmowermashine.com
braceletsstore.net
admappy.com
tollivercoltd.com
vaidix.com
Targets
-
-
Target
order.exe
-
Size
242KB
-
MD5
1fca4a7a2a1bc5631ae3bed8065a9167
-
SHA1
631a8a37179b57365515e1b4741305d75928342e
-
SHA256
27331403cd4e737d09c723eaa8ad57607f4a243a1fcde752443af581b9141092
-
SHA512
ac4bc3e02782b8ac894caa2eb536eb193e460b011bdf4926649ac4416bbf96642a7aeaa0f60a5e739ea5d7553e411e8674f4399b5a6f0443070fe963ec8739a0
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Xloader
Xloader is a rebranded version of Formbook malware.
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Xloader Payload
-
Blocklisted process makes network request
-
Executes dropped EXE
-
Loads dropped DLL
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-