General
-
Target
Produktlistenreihenfolge PDF.exe.xz
-
Size
443KB
-
Sample
230714-hrha8add4x
-
MD5
a484ccf94f9005f878fc765a1e51c451
-
SHA1
681dca883c884781b55a5ea5292b4733505cc655
-
SHA256
bba93dcaf488761169a9c3b0e24e4d4f5c4aae01d3d35d45859e3d0c6880a16e
-
SHA512
1db0dbe6a70a76866f303fdc6794f999657bbb256171089db38f440cceab45ec70c86386904bff4a13435a3a625b9d512eb69aa0d2bc117ef2745fbd536e55ce
-
SSDEEP
12288:lgVwZ6O5OQs5O6epPIpBjBhqkni92qQLKusmJd+p:2VsHb2O6eE6kq2CfEd+p
Malware Config
Extracted
formbook
4.1
t3c9
shadeshmarriagemedia.com
e-russ.com
sofiashome.com
theworriedwell.com
americantechfront.com
seasonssparkling.com
maximuscanada.net
tifin-private-markets.com
amecc2.net
xuexi22.icu
injectiontek.com
enrrocastoneimports.com
marvelouslightcandleco.com
eaamedia.com
pmediaerp.com
tikivips111.com
chesterfieldcleaningcare.com
thecrowdedtablemusic.com
duncanvillepanthers.com
floriculturajoinville.xyz
Targets
-
-
Target
Produktlistenreihenfolge PDF.exe
-
Size
856KB
-
MD5
081f7344053ca0aa8ac788a9f1feb27e
-
SHA1
9250f0db19d1f0fbe832f5d8a2fa3c54061aa375
-
SHA256
12d7296fa8ee95861d67877223842af8b28608bc8ea32cdff1c269701da3727e
-
SHA512
eeee368b90d5d15e1a3ef949f562db3815939c49b1c784b5342f290a282f48ab9579cf809e5118914309319aa139732c23d32db5dfbe4a01f9c909f16f274506
-
SSDEEP
12288:9uFlh/9H4TTkazYIYUvyQZMBi3//S0TyuXs0OJhYLfOXmxkImCcphGUXZ:9GpZazfYUyaiE60ONrpYUX
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Formbook payload
-
ModiLoader Second Stage
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-