General
-
Target
1567a43871d7c014e23af2adf4ee07504bc1032d67413fd6a73e3e5aa7241a49
-
Size
575KB
-
Sample
220613-s8za6shbam
-
MD5
8644165dbf21993c70f4489a74cbea2e
-
SHA1
380e3d0abb3e1c03e10a092f2dd14b4281cda5d3
-
SHA256
1567a43871d7c014e23af2adf4ee07504bc1032d67413fd6a73e3e5aa7241a49
-
SHA512
2fba6e4da2642627c3e967228d561bd7c651ee03e5d0945a1a47b72abde4bc15d3c4460ba45a8865e27458392b51771a2b3a09366106bb1f5edb743dcb32c3a6
Malware Config
Extracted
xloader
2.6
zgtb
gabriellep.com
honghe4.xyz
anisaofrendas.com
happy-tile.com
thesulkies.com
international-ipo.com
tazeco.info
hhhzzz.xyz
vrmonster.xyz
theearthresidencia.com
sportape.xyz
elshadaibaterias.com
koredeiihibi.com
taxtaa.com
globalcityb.com
fxivcama.com
dagsmith.com
elmar-bhp.com
peakice.net
jhcdjewelry.com
Targets
-
-
Target
1567a43871d7c014e23af2adf4ee07504bc1032d67413fd6a73e3e5aa7241a49
-
Size
575KB
-
MD5
8644165dbf21993c70f4489a74cbea2e
-
SHA1
380e3d0abb3e1c03e10a092f2dd14b4281cda5d3
-
SHA256
1567a43871d7c014e23af2adf4ee07504bc1032d67413fd6a73e3e5aa7241a49
-
SHA512
2fba6e4da2642627c3e967228d561bd7c651ee03e5d0945a1a47b72abde4bc15d3c4460ba45a8865e27458392b51771a2b3a09366106bb1f5edb743dcb32c3a6
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Xloader
Xloader is a rebranded version of Formbook malware.
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
suricata: ET MALWARE FormBook CnC Checkin (POST) M2
suricata: ET MALWARE FormBook CnC Checkin (POST) M2
-
Xloader Payload
-
Executes dropped EXE
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-