Static

static

836390a3bb...9.xlsx

windows7_x64

10

836390a3bb...9.xlsx

windows10_x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    836390a3bb832e2b10fb7bf5ee0d88e7aa32179839e65b933ff2da2aabce8f89.xlsx

  • Size

    2.1MB

  • Sample

    201210-pb5cft3rlx

  • MD5

    c30d91c05ecd94de4ee314be1f27bf22

  • SHA1

    fed9790f0ebc832445b34ef1caabe137ed15e3ce

  • SHA256

    836390a3bb832e2b10fb7bf5ee0d88e7aa32179839e65b933ff2da2aabce8f89

  • SHA512

    0053323cf2d7fada473a23ddaffd7be38f3015613f651c15bc10d524db3a656c7ed20d522feb9a7f3183efeb3588d53865a3a9d259c7707ce1dbbf2d2981fcfb

Score
10/10
formbookxloaderloaderratspywarestealertrojan

Malware Config

Extracted

Family

formbook

C2

http://www.herbmedia.net/csv8/

Decoy

slgacha.com

oohdough.com

6983ylc.com

aykassociate.com

latin-hotspot.com

starrockindia.com

beamsubway.com

queensboutique1000.com

madbaddie.com

bhoomimart.com

ankitparivar.com

aldanasanchezmx.com

citest1597669833.com

cristianofreitas.com

myplantus.com

counterfeitmilk.com

8xf39.com

pregnantwomens.com

yyyut6.com

stnanguo.com

Targets

    • Target

      836390a3bb832e2b10fb7bf5ee0d88e7aa32179839e65b933ff2da2aabce8f89.xlsx

    • Size

      2.1MB

    • MD5

      c30d91c05ecd94de4ee314be1f27bf22

    • SHA1

      fed9790f0ebc832445b34ef1caabe137ed15e3ce

    • SHA256

      836390a3bb832e2b10fb7bf5ee0d88e7aa32179839e65b933ff2da2aabce8f89

    • SHA512

      0053323cf2d7fada473a23ddaffd7be38f3015613f651c15bc10d524db3a656c7ed20d522feb9a7f3183efeb3588d53865a3a9d259c7707ce1dbbf2d2981fcfb

    Score
    10/10
    formbookxloaderloaderratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Blocklisted process makes network request

    • Executes dropped EXE

    • Loads dropped DLL

    • Uses the VBS compiler for execution

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

1
T1064

Exploitation for Client Execution

1
T1203

Persistence

Privilege Escalation

Defense Evasion

Scripting

1
T1064

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks