General
-
Target
orden grande pdf.exe.xz
-
Size
100KB
-
Sample
220627-k38nnaaaep
-
MD5
82bab8ebf2949ac930f84e71b1ff66fb
-
SHA1
ff5ddc3759591dccb2b3ec5bd37f67d0d9ec57ce
-
SHA256
7e05beb1f3567f6c96823777d029ceb27c43e7f275304e57b28f6c42bbbc099c
-
SHA512
5dee480e9380eac5ec94270809c348636b09b2f1f737f148df0003b09d45abcb4548a842e2c9376196cfd7400612a6bb562639d6af6887d7efbbd5468f2c4fc4
Malware Config
Extracted
xloader
2.6
gqvv
keyclash.com
canadianinspiration.com
testmanagement.xyz
doxpunk.xyz
kodacult.com
snatchbra.net
313370955.com
sarochin.com
norozoto.xyz
nbpanthers.com
colombiaartesanias.com
m57hwtiuu7h.com
tsaerac.com
alugiare.com
elizeusomautomotivo.com
fgijjisdifsd.xyz
isecurewebsites.com
incomeviaonline.com
caribbeanbrunch.com
alveus-solarboote.com
Extracted
formbook
4.1
n7ak
modischoolcbse.com
theneverwinter.com
rszkjx-vps-hosting.website
fnihil.com
1pbet.com
nnowzscorrez.com
uaotgvjl.icu
starmapsqatar.com
ekisilani.com
extradeepsheets.com
jam-nins.com
buranly.com
orixentertainment.com
rawtech.energy
myol.guru
utex.club
jiapie.com
wowig.store
wweidlyyl.com
systaskautomation.com
Targets
-
-
Target
orden grande pdf.exe
-
Size
241KB
-
MD5
149d29a68788c9cd599cba389698ed47
-
SHA1
cad8135bbbee484b91b87df367631b9043c2f403
-
SHA256
b92800b4c8d2200d261f52287439016dc29ba57a73d428015ab05ee98a19c159
-
SHA512
6026a7692a4a745518f2c8404a1c4b4c08e8c66f2d6fe0c9385c73d8a125bb26bba8496b4f9a492d3c8bc73140ba2173d3583435318245fe5ea0004e51a916c7
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Xloader
Xloader is a rebranded version of Formbook malware.
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
suricata: ET MALWARE FormBook CnC Checkin (POST) M2
suricata: ET MALWARE FormBook CnC Checkin (POST) M2
-
Formbook Payload
-
ModiLoader Second Stage
-
Xloader Payload
-
Adds policy Run key to start application
-
Executes dropped EXE
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-