Description
Formbook is a data stealing malware which is capable of stealing data.
SOA_OCT 2021.exe
General
Target
Size
Sample
SOA_OCT 2021.exe
269KB
211110-fqw2wagda8
Score
10 /10
MD5
SHA1
SHA256
SHA512
75f24a7fd78d30dc1287852829e55fe1
b5a09b34b18f14d44c311f84a5e705bdc6684e0c
fcf7e7eea1f4983f876bb52b0e40e09fedf69a92dcec11be50ff87e169824601
58e19c58f39ca00ff9d5be73271471eff557b7d5041d6f3d99dbb0f6417212e351f45199548e7884c5f54e52c56d8dab4d52c0f500627ca7c4647407f9c91b6d
Malware Config
Extracted
| Family | xloader |
| Version | 2.5 |
| Campaign | e8ia |
| C2 |
http://www.helpfromjames.com/e8ia/ |
| Decoy |
le-hameau-enchanteur.com quantumsystem-au.club engravedeeply.com yesrecompensas.lat cavallitowerofficials.com 800seaspray.com skifun-jetski.com thouartafoot.com nft2dollar.com petrestore.online cjcutthecord2.com tippimccullough.com gadget198.xyz djmiriam.com bitbasepay.com cukierniawz.com mcclureic.xyz inthekitchenshakinandbakin.com busy-clicks.com melaniemorris.online elysiangp.com 7bkj.com wakeanddraw.com ascalar.com iteraxon.com henleygirlscricket.com torresflooringdecorllc.com helgquieta.quest xesteem.com graffity-aws.com bolerparts.com andriylysenko.com bestinvest-4-you.com frelsicycling.com airductcleaningindianapolis.net nlproperties.net alkoora.xyz sakiyaman.com wwwsmyrnaschooldistrict.com unitedsafetyassociation.com fiveallianceapparel.com edgelordkids.com herhauling.com intelldat.com weprepareamerica-planet.com webartsolution.net yiquge.com marraasociados.com dentalimplantnearyou-ca.space linemanbible.com |
Targets
Target
MD5
Filesize
SOA_OCT 2021.exe
75f24a7fd78d30dc1287852829e55fe1
269KB
Score
10/10
SHA1
SHA256
SHA512
b5a09b34b18f14d44c311f84a5e705bdc6684e0c
fcf7e7eea1f4983f876bb52b0e40e09fedf69a92dcec11be50ff87e169824601
58e19c58f39ca00ff9d5be73271471eff557b7d5041d6f3d99dbb0f6417212e351f45199548e7884c5f54e52c56d8dab4d52c0f500627ca7c4647407f9c91b6d
Tags
Signatures
-
Formbook
-
Xloader
Description
Xloader is a rebranded version of Formbook malware.
Tags
-
Xloader Payload
Tags
-
Adds policy Run key to start application
Tags
TTPs
-
Executes dropped EXE
-
Deletes itself
-
Loads dropped DLL
-
Reads user/profile data of web browsers
Description
Infostealers often target stored browser data, which can include saved credentials etc.
Tags
TTPs
-
Suspicious use of SetThreadContext
Related Tasks
MITRE ATT&CK Matrix
Collection
Command and Control
Credential Access
Defense Evasion
Execution
Exfiltration
Impact
Initial Access
Lateral Movement
Persistence
Privilege Escalation
Tasks