Overview

overview

10

Static

static

4fa3936191...d6.exe

windows7_x64

10

4fa3936191...d6.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    4fa3936191c0b02e997c58d7dd7760d6.exe

  • Size

    1.1MB

  • Sample

    201218-3z64qd2dxx

  • MD5

    4fa3936191c0b02e997c58d7dd7760d6

  • SHA1

    ba46720f07be202d116cecd4b667449821ae64d7

  • SHA256

    549de81621fd5e577a164009e14fe791e2099b1a985fe37739801fdf156800b8

  • SHA512

    ca5e338d55afa4d3cf3371eb37e565123669d8c24b4a012f6377205d1e98392e4678726e0b49441c9e9dfe23b92054020f4648b60993ed83a35d0a6d331f5be6

Score
10/10
formbookmodiloaderxloaderloaderpersistenceratspywarestealertrojan

Malware Config

Extracted

Family

formbook

C2

http://www.herbmedia.net/csv8/

Decoy

slgacha.com

oohdough.com

6983ylc.com

aykassociate.com

latin-hotspot.com

starrockindia.com

beamsubway.com

queensboutique1000.com

madbaddie.com

bhoomimart.com

ankitparivar.com

aldanasanchezmx.com

citest1597669833.com

cristianofreitas.com

myplantus.com

counterfeitmilk.com

8xf39.com

pregnantwomens.com

yyyut6.com

stnanguo.com

Targets

    • Target

      4fa3936191c0b02e997c58d7dd7760d6.exe

    • Size

      1.1MB

    • MD5

      4fa3936191c0b02e997c58d7dd7760d6

    • SHA1

      ba46720f07be202d116cecd4b667449821ae64d7

    • SHA256

      549de81621fd5e577a164009e14fe791e2099b1a985fe37739801fdf156800b8

    • SHA512

      ca5e338d55afa4d3cf3371eb37e565123669d8c24b4a012f6377205d1e98392e4678726e0b49441c9e9dfe23b92054020f4648b60993ed83a35d0a6d331f5be6

    Score
    10/10
    formbookmodiloaderxloaderloaderpersistenceratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • ModiLoader First Stage

    • Xloader Payload

      rat

    • Adds policy Run key to start application

      persistence

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

2
T1060

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks