Overview

overview

10

Static

static

148b63c2b8...f0.exe

windows7_x64

10

148b63c2b8...f0.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    148b63c2b85f806c7c3036f854b1c6f0.exe

  • Size

    253KB

  • Sample

    220512-jczgmadhbn

  • MD5

    148b63c2b85f806c7c3036f854b1c6f0

  • SHA1

    43b8071712dc21a04140a2eae003380b7575f7e8

  • SHA256

    ca4112bb9a7b776f14e9085c5b3ecaa7458ecaaa4c2515b79978d7f99eca768f

  • SHA512

    b16af075fc1a9569d6898d58f623a8af277b09543130afaf9e21a710032d1545c42b37530514cb0d080ed3afcc028317573ae5cdd7c2fac5bbb87e0ac80f99d2

Score
10/10
formbookxloaderarh2loaderpersistenceratspywarestealersuricatatrojan

Malware Config

Extracted

Family

xloader

Version

2.6

Campaign

arh2

Decoy

hstorc.com

blackountry.com

dhrbakery.com

dezhouofit.com

defipayout.xyz

ginas4t.com

byzbh63.xyz

qrcrashview.com

mialibaby.com

enhaut.net

samainnova.com

yashveerresort.com

delfos.online

dungcumay.com

lj-counseling.net

fliptheswitch.pro

padogbitelawyer.com

aticarev.com

sederino.site

bestplansforpets-japan3.life

Targets

    • Target

      148b63c2b85f806c7c3036f854b1c6f0.exe

    • Size

      253KB

    • MD5

      148b63c2b85f806c7c3036f854b1c6f0

    • SHA1

      43b8071712dc21a04140a2eae003380b7575f7e8

    • SHA256

      ca4112bb9a7b776f14e9085c5b3ecaa7458ecaaa4c2515b79978d7f99eca768f

    • SHA512

      b16af075fc1a9569d6898d58f623a8af277b09543130afaf9e21a710032d1545c42b37530514cb0d080ed3afcc028317573ae5cdd7c2fac5bbb87e0ac80f99d2

    Score
    10/10
    formbookxloaderarh2loaderpersistenceratspywarestealersuricatatrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • suricata: ET MALWARE FormBook CnC Checkin (GET)

      suricata: ET MALWARE FormBook CnC Checkin (GET)

      suricata

    • suricata: ET MALWARE FormBook CnC Checkin (POST) M2

      suricata: ET MALWARE FormBook CnC Checkin (POST) M2

      suricata

    • Xloader Payload

      rat

    • Adds policy Run key to start application

      persistence

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

2
T1060

Privilege Escalation

Defense Evasion

Modify Registry

3
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks