Overview

overview

10

Static

static

PO#101581.exe

windows7_x64

10

PO#101581.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    PO#101581.exe

  • Size

    869KB

  • Sample

    220521-lz2xdabfc6

  • MD5

    95f35b3fb58633c97069fe1bc12f39f5

  • SHA1

    e1ee2cf79953cc0f472c9b3af9fcc389a5bc492d

  • SHA256

    151572bec6e274bad481a8c0736a4888931c086f3fdf890be9811eae7c0c0c36

  • SHA512

    358656d5e219d138a56e25f54b890a98062b5539db4da25685e659276ecfafa68c00ffa83383dac8d35cfe6270eec87da8b306a61a125128869e61ffb934d050

Score
10/10
formbookxloaderssmmloaderpersistenceratspywarestealersuricatatrojan

Malware Config

Extracted

Family

xloader

Version

2.6

Campaign

ssmm

Decoy

bhealthybu.com

formasyonlar.com

huddleadvising.com

iroofer.net

pokerisparadise.com

partnrsocial.com

omnixinity.com

sandibet.biz

xxxpool.xyz

mainsuranceagency.com

filipkaarrtofffers.online

txgongsi.com

bonasuplementos.com

sxp89app.space

grandeurjewelryph.com

productsorcerer.com

mrussellhandyman.com

igorstelea.com

cateraevents.com

yashaswistudio.com

Targets

    • Target

      PO#101581.exe

    • Size

      869KB

    • MD5

      95f35b3fb58633c97069fe1bc12f39f5

    • SHA1

      e1ee2cf79953cc0f472c9b3af9fcc389a5bc492d

    • SHA256

      151572bec6e274bad481a8c0736a4888931c086f3fdf890be9811eae7c0c0c36

    • SHA512

      358656d5e219d138a56e25f54b890a98062b5539db4da25685e659276ecfafa68c00ffa83383dac8d35cfe6270eec87da8b306a61a125128869e61ffb934d050

    Score
    10/10
    formbookxloaderssmmloaderpersistenceratspywarestealersuricatatrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • suricata: ET MALWARE FormBook CnC Checkin (GET)

      suricata: ET MALWARE FormBook CnC Checkin (GET)

      suricata

    • suricata: ET MALWARE FormBook CnC Checkin (POST) M2

      suricata: ET MALWARE FormBook CnC Checkin (POST) M2

      suricata

    • Xloader Payload

      rat

    • Adds policy Run key to start application

      persistence

    • Executes dropped EXE

    • Deletes itself

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Command-Line Interface

1
T1059

Persistence

Registry Run Keys / Startup Folder

2
T1060

Privilege Escalation

Defense Evasion

Modify Registry

3
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks