Overview

overview

10

Static

static

Purchase O...df.exe

windows7_x64

10

Purchase O...df.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Purchase Order_80976678_pdf.exe

  • Size

    351KB

  • Sample

    210119-5stpt97s5j

  • MD5

    a709f543a19335dd25778eb0dfe66cb4

  • SHA1

    16f5f3c6cdefa863184ee9081a32af736e07eefa

  • SHA256

    f45429329da30ae0032b202f9e9165b0a6b3bba97389590026c17b8c71f03f11

  • SHA512

    3cde3c37daa1a347ec0d76acfe6bd1537c5c32963446e8bddef8ceca79cbe12af36a0b77baf89785b246cdd88bcbba5e3c9ce9d4f1f1a1df19a3a77f4a6587b3

Score
10/10
formbookxloaderloaderratspywarestealertrojan

Malware Config

Extracted

Family

formbook

C2

http://www.chuanxingtong.com/j5an/

Decoy

xwwgj.com

release-paypal.com

investorshighway.com

maglex.info

chenangopistolpermit.com

thebihareye.com

sanjosemasks.com

foremanmotors.com

stadtstreicherin.com

9247pf.com

erenvincplatform.xyz

cushcaps.com

flatisteam.com

kojyouibennto.com

rahmatsuparman.com

vallyfades.online

metropitstop.com

shopasha.com

windycitycreditsolutions.com

uproxysite.com

Targets

    • Target

      Purchase Order_80976678_pdf.exe

    • Size

      351KB

    • MD5

      a709f543a19335dd25778eb0dfe66cb4

    • SHA1

      16f5f3c6cdefa863184ee9081a32af736e07eefa

    • SHA256

      f45429329da30ae0032b202f9e9165b0a6b3bba97389590026c17b8c71f03f11

    • SHA512

      3cde3c37daa1a347ec0d76acfe6bd1537c5c32963446e8bddef8ceca79cbe12af36a0b77baf89785b246cdd88bcbba5e3c9ce9d4f1f1a1df19a3a77f4a6587b3

    Score
    10/10
    formbookxloaderloaderratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Deletes itself

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Command-Line Interface

1
T1059

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks