e26afb2a71bab91e3f2dd8588da0a49436a1b09c48cccb611c06a0ed96f85f8c

General
Target

e26afb2a71bab91e3f2dd8588da0a49436a1b09c48cccb611c06a0ed96f85f8c

Size

445KB

Sample

220521-n5eedahger

Score
10 /10
MD5

434397be5732a503e4a7d058e9a55253

SHA1

82bc62dc54ef61b3f95163832d05f4a62bb1e627

SHA256

e26afb2a71bab91e3f2dd8588da0a49436a1b09c48cccb611c06a0ed96f85f8c

SHA512

24f74203d9bbac63264c70de6e7636af501db107620dfe934662e3fa66a74e0fc36f641ca9c6ca75cfccca965693048bb628778d0c3dde9798a2bcf92f7fddb1

Malware Config

Extracted

Family xloader
Version 2.1
Campaign cvd
Decoy

wanda-dutyfree.net

m399999.com

adultoutopico.com

acappellawebradio.com

geetaisprings.com

californiacredit.repair

view-merchant.review

autoritecenter.com

lke7992.com

carroceriasalchichica.com

shanhaishidai.com

wuyounice.com

ahyingshi.com

eurocrypt.net

zvxhs.info

nxsexyvip.com

suffolkbuildingcontrol.com

sotruemobiledetailing.com

bizsolmx.com

personalidea.net

c-aesthetics.com

quanguixs.com

szhgprt.com

conferenceinmelbourne2017.com

smilevillage.win

woyaodani.com

woltbikes.com

tbmbgb.tech

truelovethatlasts.com

vidsummitlive.com

southalabamahomeschooling.com

chakrabalancetherapy.com

cross-bag.com

livest1ontheplains.com

gaemari.com

werebeancoffee.com

membershipmarketing.info

pakistaniinstitute.com

submarr.com

rideordie2k19.com

ramelgayrimenkul.com

web-start.info

playawesomeslots.com

appletreefarm.info

mightyheartspreschool.com

onoraodalis.net

settesecondicirca.com

clmsys.biz

fahabok.com

warwickfoodconsultants.com

Targets
Target

e26afb2a71bab91e3f2dd8588da0a49436a1b09c48cccb611c06a0ed96f85f8c

MD5

434397be5732a503e4a7d058e9a55253

Filesize

445KB

Score
3/10
SHA1

82bc62dc54ef61b3f95163832d05f4a62bb1e627

SHA256

e26afb2a71bab91e3f2dd8588da0a49436a1b09c48cccb611c06a0ed96f85f8c

SHA512

24f74203d9bbac63264c70de6e7636af501db107620dfe934662e3fa66a74e0fc36f641ca9c6ca75cfccca965693048bb628778d0c3dde9798a2bcf92f7fddb1

Related Tasks

Target

Quotation DG-H2091717 Order.exe

MD5

281adb9d80c76b1d55dd373ea0c9d76a

Filesize

491KB

Score
10/10
SHA1

961c9d2108da9e4f91f1c38b3202eb582cea3f94

SHA256

510b24a8ddcc1a99925f07d8ec0b56489930147a95810b787291b3396bd54a7c

SHA512

f6a124e8a412801f5d0c9bac388da732b26bf66b84fcf1cce0bbd13c3f9107132fffe5b9e4d19f3f5f572a835cb0ac700bc83542cedcc39860133536d32aae93

Tags

Signatures

  • Formbook

    Description

    Formbook is a data stealing malware which is capable of stealing data.

    Tags

  • Xloader

    Description

    Xloader is a rebranded version of Formbook malware.

    Tags

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    Description

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    Tags

  • Xloader Payload

    Tags

  • Deletes itself

  • Reads user/profile data of web browsers

    Description

    Infostealers often target stored browser data, which can include saved credentials etc.

    Tags

    TTPs

    Data from Local SystemCredentials in Files
  • Adds Run key to start application

    Tags

    TTPs

    Registry Run Keys / Startup FolderModify Registry
  • Suspicious use of SetThreadContext

Related Tasks

MITRE ATT&CK Matrix
Command and Control
    Credential Access
    Defense Evasion
    Execution
      Exfiltration
        Impact
          Initial Access
            Lateral Movement
              Privilege Escalation
                Tasks

                static1

                behavioral1

                3/10

                behavioral2

                3/10

                behavioral3

                10/10