General
-
Target
092726376263728.DOC.zip
-
Size
475KB
-
Sample
230510-xw3kaahh66
-
MD5
26ec8c56bbc594081afcee37dcb2ba4d
-
SHA1
6da3ea27a818969fc2831ef8c3bb7430341e75b7
-
SHA256
0d697faaa434aab1f13b7b2fe781352880ae9ceda6b9430f6af0950f5ca832e3
-
SHA512
78f43ebb4b96e1795bc74ed237573230e1cb4c5661022a489af24838fc25c4923ff02359beb211847a43755f35d02e01d2c16d287cb6058e27eab40e003a200f
-
SSDEEP
12288:tDRy+0jLbF7YR4/V8POSggNkk9Nlih89ksTWyMxS:1c+qlsQq1rRG4v
Malware Config
Extracted
xloader
2.6
uj3c
copimetro.com
choonchain.com
luxxwireless.com
fashionweekofcincinnati.com
campingshare.net
suncochina.com
kidsfundoor.com
testingnyc.co
lovesoe.com
vehiclesbeenrecord.com
socialpearmarketing.com
maxproductdji.com
getallarticle.online
forummind.com
arenamarenostrum.com
trisuaka.xyz
designgamagazine.com
chateaulehotel.com
huangse5.com
esginvestment.tech
Targets
-
-
Target
092726376263728.DOC.exe
-
Size
798KB
-
MD5
fc317530c3a698867861a965caa34bad
-
SHA1
2700a38ef604d78793da302664afc7d27bbb0b1c
-
SHA256
9973a0ac74f8649b431499862359352cc0e8639f4f46ae5ae2371fcdaaf31320
-
SHA512
f01c04b08d76f7eef6426a129dc39ea1ab60d99c52804b999b4b89c53d6d83f0ad17db311186f899f4924a5bdd38577ef8d803ae909ff700ccb68c66511d3db9
-
SSDEEP
12288:TNLhcjoS4FC7ITh3IBPmOt50Pbkttml53kbXJ2zlLj0:T9hcsFCMTaFCKIsbZ2h
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Xloader
Xloader is a rebranded version of Formbook malware.
-
ModiLoader Second Stage
-
Xloader payload
-
Adds policy Run key to start application
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-