Overview

overview

10

Static

static

vbc.exe

windows7_x64

10

vbc.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    vbc.exe

  • Size

    889KB

  • Sample

    210118-ddzval6jtx

  • MD5

    786180a5141bf4ea48e26910d2bf9061

  • SHA1

    f77224c2ac0c9dd746fc22b102da2a534bf889e2

  • SHA256

    63289870bb6e2bbb13afd47bf630c048e593afacc5c968939855f85ca5022ea4

  • SHA512

    cbdb00fe20e39c52ac736e75bc2c93abecc0d0ecbc9c10d7b62e88f6e574f99ee545a5ca34578dcdc564cd32fe3e9fb1258bc35d09304b094a32c2f89a492d28

Score
10/10
formbookxloaderloaderratspywarestealertrojan

Malware Config

Extracted

Family

formbook

C2

http://www.stonescapes1.com/de92/

Decoy

zindaginews.com

tyelevator.com

schustermaninterests.com

algemixdelchef.com

doubscollectivites.com

e-butchery.com

hellbentmask.com

jumbpprivacy.com

teeniestiedye.com

playfulartwork.com

desertvacahs.com

w5470-hed.net

nepalearningpods.com

smoothandsleek.com

thecannaglow.com

torrentkittyla.com

industrytoyou.com

raquelvargas.net

rlc-nc.net

cryptoprises.com

Targets

    • Target

      vbc.exe

    • Size

      889KB

    • MD5

      786180a5141bf4ea48e26910d2bf9061

    • SHA1

      f77224c2ac0c9dd746fc22b102da2a534bf889e2

    • SHA256

      63289870bb6e2bbb13afd47bf630c048e593afacc5c968939855f85ca5022ea4

    • SHA512

      cbdb00fe20e39c52ac736e75bc2c93abecc0d0ecbc9c10d7b62e88f6e574f99ee545a5ca34578dcdc564cd32fe3e9fb1258bc35d09304b094a32c2f89a492d28

    Score
    10/10
    formbookxloaderloaderratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Deletes itself

    • Uses the VBS compiler for execution

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

1
T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

1
T1064

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks