General
-
Target
vbc.exe
-
Size
2.8MB
-
Sample
220811-lde6gsddhr
-
MD5
980a1110e94708d0905a1d8acde8eb23
-
SHA1
cc9d0dfaaaf59f88efc40c10f35e002cdc9a0b50
-
SHA256
f8d6a16b03802e68ec4cef31e3007e6d58d8124f9e695fdd625b99cb2502939c
-
SHA512
f829ccf02b2948850d0c47218e901bc2ca2dc5c6d1c2075906cfcbd4ab472e1e638f93ee71eaa91e72a12fe7d55e99edfcdc7d22255e68df839c493c7153034a
Malware Config
Extracted
xloader
2.6
zgtb
gabriellep.com
honghe4.xyz
anisaofrendas.com
happy-tile.com
thesulkies.com
international-ipo.com
tazeco.info
hhhzzz.xyz
vrmonster.xyz
theearthresidencia.com
sportape.xyz
elshadaibaterias.com
koredeiihibi.com
taxtaa.com
globalcityb.com
fxivcama.com
dagsmith.com
elmar-bhp.com
peakice.net
jhcdjewelry.com
Targets
-
-
Target
vbc.exe
-
Size
2.8MB
-
MD5
980a1110e94708d0905a1d8acde8eb23
-
SHA1
cc9d0dfaaaf59f88efc40c10f35e002cdc9a0b50
-
SHA256
f8d6a16b03802e68ec4cef31e3007e6d58d8124f9e695fdd625b99cb2502939c
-
SHA512
f829ccf02b2948850d0c47218e901bc2ca2dc5c6d1c2075906cfcbd4ab472e1e638f93ee71eaa91e72a12fe7d55e99edfcdc7d22255e68df839c493c7153034a
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Xloader
Xloader is a rebranded version of Formbook malware.
-
Xloader payload
-
Adds policy Run key to start application
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Uses the VBS compiler for execution
-
Suspicious use of SetThreadContext
-