formbook

General

Target

48dd5584cf3d6c0930f09e335d98d4fd
Size

294KB
Sample

220217-xbmckadbe5
MD5

48dd5584cf3d6c0930f09e335d98d4fd
SHA1

a072e576904888726dda9ad1c61673492cd72eae
SHA256

22d5552fed81b606509972d3c12830cd2cfcd77ec68a8791706099e97b2c1bad
SHA512

95492bb4e2a9f51f5ff547d2b7e534787cac49d7004a146bdf3df01d7f22f478a7f89f19f1fb411487d8b58b153223e093db44fc6441696091302459d6c3b9e9

Score

10^/10

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

t9hh

Decoy

mine.vin

terpenebase.com

potomarket.com

lmaproshop.com

multitecsd.com

vacationrentalsct.com

france-gravure.com

schoolq8.com

caravan777.com

mimtgexpert.com

animesomurie.com

buscalogps.online

legionstudio.net

pdam.top

galapaleso.quest

gulfweeks.com

sedonasuperfit.online

arab-xt-pro.com

fifeapartment.com

pitchgiving.com

Extracted

Family

njrat

Version

0.7d

Botnet

Slaves

C2

hom135.ddns.net:100

Mutex

d4903fdacbb79e6cd1109a741a2bc821

Attributes

reg_key
d4903fdacbb79e6cd1109a741a2bc821
splitter
|'|'|

Targets

- Target
  
  48dd5584cf3d6c0930f09e335d98d4fd
- Size
  
  294KB
- MD5
  
  48dd5584cf3d6c0930f09e335d98d4fd
- SHA1
  
  a072e576904888726dda9ad1c61673492cd72eae
- SHA256
  
  22d5552fed81b606509972d3c12830cd2cfcd77ec68a8791706099e97b2c1bad
- SHA512
  
  95492bb4e2a9f51f5ff547d2b7e534787cac49d7004a146bdf3df01d7f22f478a7f89f19f1fb411487d8b58b153223e093db44fc6441696091302459d6c3b9e9
Score

10^/10

formbook njrat xloader slaves t9hh bootkit evasion loader persistence rat spyware stealer trojan upx
- Formbook
  Formbook is a data stealing malware which is capable of stealing data.
  trojan spyware stealer formbook
- Xloader
  Xloader is a rebranded version of Formbook malware.
  loader xloader
- njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- Xloader Payload
  rat
- Blocklisted process makes network request
- Executes dropped EXE
- Modifies Windows Firewall
  evasion
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- Suspicious use of SetThreadContext
behavioral1