Overview

overview

10

Static

static

1

be6ece1b65...8b.exe

windows7_x64

10

be6ece1b65...8b.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    be6ece1b6510c986870d8ceabb87988b

  • Size

    292KB

  • Sample

    220210-y3vcxshce5

  • MD5

    be6ece1b6510c986870d8ceabb87988b

  • SHA1

    63795ce8b9c7fd5ec3374e3e012b3898a8695f53

  • SHA256

    b7cf8d9d8db4c5eaf796d35251bfc2b24f34c2c77d2ca82a1ebf470323c0894f

  • SHA512

    c7296be4cf5c14ada776312ceeedd29b52b6e4e228e6f1453e5485571099f6c517e90c6f33b88835b51130056bca6d2401d1bd6aed7e0b9d590d3b7b2c60a334

Score
10/10
formbookxloaderp2a5loaderpersistenceratspywarestealertrojan

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

p2a5

Decoy

gorillaslovebananas.com

zonaextasis.com

digitalpravin.online

memorialdoors.com

departmenteindhoven.com

vipulb.com

ruyibao365.com

ynpzz.com

matthewandjessica.com

winfrey2024.com

janetride.com

arairazur.xyz

alltheheads.com

amayawebdesigns.com

califunder.com

blacksource.xyz

farmasi.agency

ilmkibahar.com

thinkcentury.net

eskortclub.com

Targets

    • Target

      be6ece1b6510c986870d8ceabb87988b

    • Size

      292KB

    • MD5

      be6ece1b6510c986870d8ceabb87988b

    • SHA1

      63795ce8b9c7fd5ec3374e3e012b3898a8695f53

    • SHA256

      b7cf8d9d8db4c5eaf796d35251bfc2b24f34c2c77d2ca82a1ebf470323c0894f

    • SHA512

      c7296be4cf5c14ada776312ceeedd29b52b6e4e228e6f1453e5485571099f6c517e90c6f33b88835b51130056bca6d2401d1bd6aed7e0b9d590d3b7b2c60a334

    Score
    10/10
    xloaderp2a5loaderratformbookpersistencespywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Suspicious use of NtCreateProcessExOtherParentProcess

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Adds policy Run key to start application

      persistence

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

System Information Discovery

3
T1082

Query Registry

2
T1012

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks