Overview

overview

10

Static

static

dGWioTejLEz0eVM.exe

windows7_x64

10

dGWioTejLEz0eVM.exe

windows10_x64

10

Resubmissions

19-01-2021 19:04

210119-xh2whbp67e 10

19-01-2021 13:01

210119-g3xne1nhpa 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    dGWioTejLEz0eVM.exe

  • Size

    1.5MB

  • Sample

    210119-g3xne1nhpa

  • MD5

    25ed69d3ea7c4da59aa0a482ee4b6ab5

  • SHA1

    a2e4f6b50343a85ade04e9d168b0a8cc9cfd9af5

  • SHA256

    f1cb70b8963d11aab0392a24161c0851f2d320d62aa101c3f960bcf0d7d94619

  • SHA512

    51f66bb3b175192b824493df2ea5c99f47a3224751d3bc3ef057c5649c152ef47bd8c82f2d3f041de9bf3808c1822db2206e84b6fa98392755fcfa2e641ff75a

Score
10/10
formbookxloaderloaderratspywarestealertrojan

Malware Config

Extracted

Family

formbook

C2

http://www.besteprobioticakopen.online/uszn/

Decoy

animegriptape.com

pcpnetworks.com

putupmybabyforadoption.com

xn--jvrr98g37n88d.com

fertinvitro.doctor

undonethread.com

avoleague.com

sissysundays.com

guilhermeoliveiro.site

catholicon-bespeckle.info

mardesuenosfundacion.com

songkhoe24.site

shoecityindia.com

smallbathroomdecor.info

tskusa.com

prairiespringsllc.com

kegncoffee.com

clicklounge.xyz

catholicendoflifeplanning.com

steelobzee.com

Targets

    • Target

      dGWioTejLEz0eVM.exe

    • Size

      1.5MB

    • MD5

      25ed69d3ea7c4da59aa0a482ee4b6ab5

    • SHA1

      a2e4f6b50343a85ade04e9d168b0a8cc9cfd9af5

    • SHA256

      f1cb70b8963d11aab0392a24161c0851f2d320d62aa101c3f960bcf0d7d94619

    • SHA512

      51f66bb3b175192b824493df2ea5c99f47a3224751d3bc3ef057c5649c152ef47bd8c82f2d3f041de9bf3808c1822db2206e84b6fa98392755fcfa2e641ff75a

    Score
    10/10
    formbookxloaderloaderratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Deletes itself

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Command-Line Interface

1
T1059

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks