formbook

General

Target

e26afb2a71bab91e3f2dd8588da0a49436a1b09c48cccb611c06a0ed96f85f8c
Size

445KB
Sample

220521-n5eedahger
MD5

434397be5732a503e4a7d058e9a55253
SHA1

82bc62dc54ef61b3f95163832d05f4a62bb1e627
SHA256

e26afb2a71bab91e3f2dd8588da0a49436a1b09c48cccb611c06a0ed96f85f8c
SHA512

24f74203d9bbac63264c70de6e7636af501db107620dfe934662e3fa66a74e0fc36f641ca9c6ca75cfccca965693048bb628778d0c3dde9798a2bcf92f7fddb1

Score

10^/10

Malware Config

Extracted

Family

xloader

Version

2.1

Campaign

cvd

Decoy

wanda-dutyfree.net

m399999.com

adultoutopico.com

acappellawebradio.com

geetaisprings.com

californiacredit.repair

view-merchant.review

autoritecenter.com

lke7992.com

carroceriasalchichica.com

shanhaishidai.com

wuyounice.com

ahyingshi.com

eurocrypt.net

zvxhs.info

nxsexyvip.com

suffolkbuildingcontrol.com

sotruemobiledetailing.com

bizsolmx.com

personalidea.net

Targets

- Target
  
  e26afb2a71bab91e3f2dd8588da0a49436a1b09c48cccb611c06a0ed96f85f8c
- Size
  
  445KB
- MD5
  
  434397be5732a503e4a7d058e9a55253
- SHA1
  
  82bc62dc54ef61b3f95163832d05f4a62bb1e627
- SHA256
  
  e26afb2a71bab91e3f2dd8588da0a49436a1b09c48cccb611c06a0ed96f85f8c
- SHA512
  
  24f74203d9bbac63264c70de6e7636af501db107620dfe934662e3fa66a74e0fc36f641ca9c6ca75cfccca965693048bb628778d0c3dde9798a2bcf92f7fddb1
Score

3^/10
behavioral1 behavioral2
- Target
  
  Quotation DG-H2091717 Order.exe
- Size
  
  491KB
- MD5
  
  281adb9d80c76b1d55dd373ea0c9d76a
- SHA1
  
  961c9d2108da9e4f91f1c38b3202eb582cea3f94
- SHA256
  
  510b24a8ddcc1a99925f07d8ec0b56489930147a95810b787291b3396bd54a7c
- SHA512
  
  f6a124e8a412801f5d0c9bac388da732b26bf66b84fcf1cce0bbd13c3f9107132fffe5b9e4d19f3f5f572a835cb0ac700bc83542cedcc39860133536d32aae93
Score

10^/10

xloader cvd loader rat formbook persistence spyware stealer suricata trojan
- Formbook
  Formbook is a data stealing malware which is capable of stealing data.
  trojan spyware stealer formbook
- Xloader
  Xloader is a rebranded version of Formbook malware.
  loader xloader
- suricata: ET MALWARE FormBook CnC Checkin (GET)
  suricata: ET MALWARE FormBook CnC Checkin (GET)
  suricata
- Xloader Payload
  rat
- Deletes itself
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral3 behavioral4