General
-
Target
e51a877a08968fce532ee3fcce4b4068
-
Size
613KB
-
Sample
220606-zq7yxsbhd4
-
MD5
e51a877a08968fce532ee3fcce4b4068
-
SHA1
06528cb29314da5cf880a3087c21cbf78af546eb
-
SHA256
c0682fddc02723c5c9caf15217176fe2fad5e6fa50c6882c2dac45973639538b
-
SHA512
2dc329b76efbbf683254e529a056243fb8465c623aabedb2b03f4e1d56bcc94e4fa0d72bb53c92f31e430bed613599622eb6f33f76c3088f0e976a0257095452
Malware Config
Extracted
xloader
2.6
uj3c
copimetro.com
choonchain.com
luxxwireless.com
fashionweekofcincinnati.com
campingshare.net
suncochina.com
kidsfundoor.com
testingnyc.co
lovesoe.com
vehiclesbeenrecord.com
socialpearmarketing.com
maxproductdji.com
getallarticle.online
forummind.com
arenamarenostrum.com
trisuaka.xyz
designgamagazine.com
chateaulehotel.com
huangse5.com
esginvestment.tech
Extracted
formbook
4.1
n7ak
modischoolcbse.com
theneverwinter.com
rszkjx-vps-hosting.website
fnihil.com
1pbet.com
nnowzscorrez.com
uaotgvjl.icu
starmapsqatar.com
ekisilani.com
extradeepsheets.com
jam-nins.com
buranly.com
orixentertainment.com
rawtech.energy
myol.guru
utex.club
jiapie.com
wowig.store
wweidlyyl.com
systaskautomation.com
Targets
-
-
Target
Yeni siparis eklendi.exe
-
Size
856KB
-
MD5
ef18be7a8a68e50aca6d38f09f27e85a
-
SHA1
3fafd20f322f0b979d7f063b4fcc050e6c31f9dc
-
SHA256
6e995aee360d55b347727e8ffc0c61df76cbf467f4380840d63ec80181e2d5bf
-
SHA512
cf53775a14e4cd407f70ed978985163e0c60c6394a954b918b989036d51d4a9bcae9028831925f62831503d1b8d5f1b35e4d5b5815564dc201c159be3531486e
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Xloader
Xloader is a rebranded version of Formbook malware.
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
suricata: ET MALWARE FormBook CnC Checkin (POST) M2
suricata: ET MALWARE FormBook CnC Checkin (POST) M2
-
Formbook Payload
-
ModiLoader Second Stage
-
Xloader Payload
-
Adds policy Run key to start application
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-