formbook | 1d87d74fe3b493880a672905108416227b6a2996eae2da3d8226cf65ae8ade26

General

Target
SecuriteInfo.com.Trojan.PWS.Stealer.29819.13214.25469.exe
Size 297KB
Sample210121-ppd4fgdzzj
SHA256 1d87d74fe3b493880a672905108416227b6a2996eae2da3d8226cf65ae8ade26
MD5 2d435a73a52785b8912a447e4e205e50
SHA1 082edf778cbf0a7af0994d2a0b7d397b6a820f33
SHA512 288063c4fe25cba62a24a9cb074c0362fd137a54f378e18eb537569750f3c7c26bd1a6343ca95ab805e02cc6b789e3d5b8ecc6e3f877eecfb4fda8c5a89aa7be
MD5 SHA1 SHA512

Score

10^/10

Family

C2

Decoy

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook
Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 1 IoCs

rat

resource	yara_rule
behavioral1/memory/1924-3-0x0000000000400000-0x0000000000429000-memory.dmp	xloader

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 792 set thread context of 1924	792	SecuriteInfo.com.Trojan.PWS.Stealer.29819.13214.25469.exe	26

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1924	SecuriteInfo.com.Trojan.PWS.Stealer.29819.13214.25469.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
792	SecuriteInfo.com.Trojan.PWS.Stealer.29819.13214.25469.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 792 wrote to memory of 1924	792	SecuriteInfo.com.Trojan.PWS.Stealer.29819.13214.25469.exe	26
PID 792 wrote to memory of 1924	792	SecuriteInfo.com.Trojan.PWS.Stealer.29819.13214.25469.exe	26
PID 792 wrote to memory of 1924	792	SecuriteInfo.com.Trojan.PWS.Stealer.29819.13214.25469.exe	26
PID 792 wrote to memory of 1924	792	SecuriteInfo.com.Trojan.PWS.Stealer.29819.13214.25469.exe	26
PID 792 wrote to memory of 1924	792	SecuriteInfo.com.Trojan.PWS.Stealer.29819.13214.25469.exe	26

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PWS.Stealer.29819.13214.25469.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PWS.Stealer.29819.13214.25469.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:792
- C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PWS.Stealer.29819.13214.25469.exe
  "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PWS.Stealer.29819.13214.25469.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1924

memory/1924-3-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1924-4-0x00000000008D0000-0x0000000000BD3000-memory.dmp

Download