Overview

overview

10

Static

static

1

tmp.exe

windows7_x64

10

tmp.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    tmp

  • Size

    337KB

  • Sample

    220314-wkrg7scffr

  • MD5

    922b85fda90aeb6b6b23aa0d1847794f

  • SHA1

    a414b5d924f7ee2bf1de38cdd04fdbe62a04c411

  • SHA256

    7791cb00900b2cedf11970c8f42064656b58c61721b9c230fc0ab15af40479d1

  • SHA512

    d8da6261b44dceb5f0aad76aad0a473170eda6b4b79c8a0f4fcd486e18e50bf913a903bf475ec736e0da4497b9b2922e7c7782cb8e0a3bb6fa3fa1a0ab120f59

Score
10/10
formbookxloaderp2a5loaderpersistenceratspywarestealersuricatatrojan

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

p2a5

Decoy

gorillaslovebananas.com

zonaextasis.com

digitalpravin.online

memorialdoors.com

departmenteindhoven.com

vipulb.com

ruyibao365.com

ynpzz.com

matthewandjessica.com

winfrey2024.com

janetride.com

arairazur.xyz

alltheheads.com

amayawebdesigns.com

califunder.com

blacksource.xyz

farmasi.agency

ilmkibahar.com

thinkcentury.net

eskortclub.com

Targets

    • Target

      tmp

    • Size

      337KB

    • MD5

      922b85fda90aeb6b6b23aa0d1847794f

    • SHA1

      a414b5d924f7ee2bf1de38cdd04fdbe62a04c411

    • SHA256

      7791cb00900b2cedf11970c8f42064656b58c61721b9c230fc0ab15af40479d1

    • SHA512

      d8da6261b44dceb5f0aad76aad0a473170eda6b4b79c8a0f4fcd486e18e50bf913a903bf475ec736e0da4497b9b2922e7c7782cb8e0a3bb6fa3fa1a0ab120f59

    Score
    10/10
    xloaderp2a5loaderratsuricataformbookpersistencespywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • suricata: ET MALWARE FormBook CnC Checkin (GET)

      suricata: ET MALWARE FormBook CnC Checkin (GET)

      suricata

    • Xloader Payload

      rat

    • Adds policy Run key to start application

      persistence

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

3
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks