Overview

overview

10

Static

static

RFQ ORDER LIST.xlsx

windows7_x64

10

RFQ ORDER LIST.xlsx

windows10_x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    RFQ ORDER LIST.xlsx

  • Size

    2.4MB

  • Sample

    210119-k2h4g31lrs

  • MD5

    7046895bf66247768d0ea01820e10bd7

  • SHA1

    6a8dd66b8cb3a4abff011d80c2ce92cae5376a76

  • SHA256

    04565d469f7088f9fb122dd3b42274a84bdc1650156a815420381ef770e4373e

  • SHA512

    9ee04cae283b8f5edc7cfd14afe82f62266db71c8a1d8ce131b90b1832b17f02ba624caac95e1148b6b5265dcbd76e3130d90c238152adae5efb435ad49010a2

Score
10/10
formbookxloaderloaderratspywarestealertrojanupx

Malware Config

Extracted

Family

formbook

C2

http://www.hitchhikerfab.com/qjnt/

Decoy

silverlakesfootball.com

drivebymovie.com

precisedirections.com

xn--01-mlcpq1abi.xn--p1acf

landhubturkey.com

andronomicon.com

kindlyhomecare.com

tyequip.com

planfra.com

wy1197.com

blackcatbaker.com

ddhhynjy.com

sales-altigen.com

valerielimozin.com

walmamall.com

quishkambalito.com

gnbsuvm.icu

milanostorear.com

olympiaopen.com

zradydlyazhinok-ua.com

Targets

    • Target

      RFQ ORDER LIST.xlsx

    • Size

      2.4MB

    • MD5

      7046895bf66247768d0ea01820e10bd7

    • SHA1

      6a8dd66b8cb3a4abff011d80c2ce92cae5376a76

    • SHA256

      04565d469f7088f9fb122dd3b42274a84bdc1650156a815420381ef770e4373e

    • SHA512

      9ee04cae283b8f5edc7cfd14afe82f62266db71c8a1d8ce131b90b1832b17f02ba624caac95e1148b6b5265dcbd76e3130d90c238152adae5efb435ad49010a2

    Score
    10/10
    formbookxloaderloaderratspywarestealertrojanupx

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Blocklisted process makes network request

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Loads dropped DLL

    • Uses the VBS compiler for execution

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

1
T1064

Exploitation for Client Execution

1
T1203

Persistence

Privilege Escalation

Defense Evasion

Scripting

1
T1064

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks