General
-
Target
0fa91b5908e67e139b25b626a047da5ab3003187d0b22ccad00cce2e503a350f
-
Size
609KB
-
Sample
220521-n35hsaeeg4
-
MD5
c607e8da28ea05a0d8af082f73a1e889
-
SHA1
656151329ba5e185306fd771e8a77ba2bc77d0fb
-
SHA256
0fa91b5908e67e139b25b626a047da5ab3003187d0b22ccad00cce2e503a350f
-
SHA512
1ff4c4725e21f8c13ec3084073912713140f4ce57d2b1ab820799e17f09e97d9bc3bc33434ed7e42dd3a59d4e1bb7b5663693bf97dfe3770c9ec6a4ce0856f36
Malware Config
Extracted
modiloader
https://drive.google.com/u/0/uc?id=1CrIxeE3bKxWj_7ScJWKAZssR-K0cjUiK&export=download
Extracted
formbook
4.1
3nop
bakecakesandmore.com
shenglisuoye.com
chinapopfactory.com
ynlrhd.com
liqourforyou.com
leonqamil.com
meccafon.com
online-marketing-strategie.biz
rbfxi.com
frseyb.info
leyu91.com
hotsmail.today
beepot.tech
dunaemmetmobility.com
sixpenceworkshop.com
incrediblefavorcoaching.com
pofo.info
yanshudaili.com
yellowbrickwedding.com
paintpartyblueprint.com
Targets
-
-
Target
New Order.exe
-
Size
1.2MB
-
MD5
eec43b73ccd5f26bbaba81ffc080a573
-
SHA1
09a79460db647ec8c12328bfc9b8c4daaa86cf72
-
SHA256
939863edcaf7c655fb6e3020bdfe5138bf6e61faa3d3b037f113216ccc1be55a
-
SHA512
a45a33f0de9c282f78001bd0c9621e5f86dc82466f51c669015f1eb3a94c60c9adc7ebcd5e881a237f2271b3fe3056155255e2e8e6e75129ee631ba4d07d8e97
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Formbook Payload
-
ModiLoader First Stage
-
Adds policy Run key to start application
-
Adds Run key to start application
-
Legitimate hosting services abused for malware hosting/C2
-
Suspicious use of SetThreadContext
-