Overview

overview

10

Static

static

PO#416421.exe

windows7_x64

10

PO#416421.exe

windows10_x64

10

Resubmissions

17-01-2021 17:41

210117-k1qw448nfe 10

15-01-2021 07:16

210115-49ldfwaptn 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    PO#416421.exe

  • Size

    176KB

  • Sample

    210117-k1qw448nfe

  • MD5

    18ec4947cbfb82bda1635a855b9b4763

  • SHA1

    6083fb410e0bd21b5bc0f635861758b2747821ab

  • SHA256

    26b068137a8264f4aba9c3617a289417ead13d0c9d53f86a3158c1d113dbf86d

  • SHA512

    3283e0b3e64df7b60b6a71f524f83b107a7ce9d577a147da3a0490bd61c5ffd373887730b33ca347cbf21608ac5cb3bbf6d6d1338377d64eaab5ff8cc5963c72

Score
10/10
formbookxloaderloaderratspywarestealertrojan

Malware Config

Extracted

Family

formbook

C2

http://www.tzmm.net/wpsb/

Decoy

0817ls.com

drawbeirut.com

respiteready.com

yufkayurek.com

poss-plus.com

distributesimilar.com

mcmendzlawns.com

bingent.info

wellnessandcomfort.com

humilityhope.com

recetasfes.com

olala.asia

epochryphal.com

room-lettings-onlines.club

lvc.xyz

reicolee.com

davidmarkphotovideo.photography

corpuschristicarbuyers.com

tutorialyoutube.com

ativ.pro

Targets

    • Target

      PO#416421.exe

    • Size

      176KB

    • MD5

      18ec4947cbfb82bda1635a855b9b4763

    • SHA1

      6083fb410e0bd21b5bc0f635861758b2747821ab

    • SHA256

      26b068137a8264f4aba9c3617a289417ead13d0c9d53f86a3158c1d113dbf86d

    • SHA512

      3283e0b3e64df7b60b6a71f524f83b107a7ce9d577a147da3a0490bd61c5ffd373887730b33ca347cbf21608ac5cb3bbf6d6d1338377d64eaab5ff8cc5963c72

    Score
    10/10
    formbookxloaderloaderratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Deletes itself

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks