General
-
Target
shipping document.r15
-
Size
467KB
-
Sample
220627-rjed2adfc2
-
MD5
f25eafbf016713062d75ab1ca1cfab0f
-
SHA1
4a2406cb7c8576e8d763d0c9a500b8cc51cb695a
-
SHA256
86e4d5f6e971a493c6d56fbdb71a4a6c6deaf7eca8c30f086bafba45159f8e22
-
SHA512
66da793a06c2c525c211e0723fb641e7955509987bd5b3f799287d746b285ecffff1bfdc0b292f63d16670ba29e74345e78cbb64aa7c8e0f5859f1841647d8ab
Malware Config
Extracted
xloader
2.6
pdrq
welchsunstar.com
mppservicesllc.com
wiresofteflon.com
brabov.xyz
compnonoch.site
yourbuilderworks.com
iamsamirahman.com
eriqoes.com
eastudio.design
skyearth-est.com
teethfitness.com
razaancreates.com
shfbfs.com
joyfulbrokekids.com
kjbolden.com
howirep.com
deedeesmainecoons.website
e-powair.com
aheatea.com
shalfey0009.xyz
Targets
-
-
Target
shipping document.exe
-
Size
521KB
-
MD5
557350a46a849eb9ae8bc28a629bf3d5
-
SHA1
8a773187553730b62bc9ba58457b8a97523f953e
-
SHA256
576d080b4cab07bd5c3ef3e5d6a222b91744368ed837a3e56eb89772c1b5a1de
-
SHA512
aee4d4881f1d20b7837f690291702c7ead7c6900f0a68fa29f6c5fbd06fc91d7d13f893b70543c172d3a3732d47262aeca3209af81cc396eddc3dd3412ccad64
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Xloader
Xloader is a rebranded version of Formbook malware.
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Looks for VirtualBox Guest Additions in registry
-
Xloader Payload
-
Adds policy Run key to start application
-
Looks for VMWare Tools registry key
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application
-
Maps connected drives based on registry
Disk information is often read in order to detect sandboxing environments.
-
Suspicious use of SetThreadContext
-