formbook

General

Target

0000876556789NMV.exe
Size

739KB
Sample

220809-g26wwsebbq
MD5

0264f957e00b1c3073570ee312fdb266
SHA1

db0eed50de0bf03b685681cddc01e85430245fe9
SHA256

f3b98621548b57b52981311a22c4b06c3644047b6bfaf01ad34467a0223fa71b
SHA512

7db312e269114be4cb9ee1bf03bdf4d0c092d6d91137e934f6e60cc71585616046fb93537fe0effb690216124b70a1c51375a3c6e02e251707eb48adfd710e14

Score

10^/10

Malware Config

Extracted

Family

xloader

Version

2.9

Campaign

zzun

Decoy

JnNtRHyNupy0GqRzAcasu7hb4rc=

Qv593NGLE7p9UNSaVkPXljAJm2QCNnc=

ePArIFWvjkkMgVEVhw4M4Jk=

26rqUwJ7dD0AiDI=

pBAxMHeK741QFw==

kHD7TPt5846pUMTX

56UnjFjHL1i0j659h3LymRnHpQj+SshC

4vKlKHflPqmWXRbrRwfPtrhb4rc=

6LBd4qButFAi

phMzGll8Ue7Fu+inq5cdnPaSugG3

NKswiQGCvZoG5FgsdHEI

rtTHnuUY8M1qVcXV

SOmECrlAt2oGAA==

L1ep9adutFAi

/UE+/AyvE6uEl28weFI=

IP+xMPQxJR4NE6TK

xvW5GN9/rqA5YUoOVt185Sf7Uw==

fRFNW9DhxL6VF7LA

KFYTfkaY741QFw==

W4JGvMBmt2oGAA==

Targets

- Target
  
  0000876556789NMV.exe
- Size
  
  739KB
- MD5
  
  0264f957e00b1c3073570ee312fdb266
- SHA1
  
  db0eed50de0bf03b685681cddc01e85430245fe9
- SHA256
  
  f3b98621548b57b52981311a22c4b06c3644047b6bfaf01ad34467a0223fa71b
- SHA512
  
  7db312e269114be4cb9ee1bf03bdf4d0c092d6d91137e934f6e60cc71585616046fb93537fe0effb690216124b70a1c51375a3c6e02e251707eb48adfd710e14
Score

10^/10

formbook xloader zzun loader persistence rat spyware stealer trojan
- Formbook
  Formbook is a data stealing malware which is capable of stealing data.
  trojan spyware stealer formbook
- Xloader
  Xloader is a rebranded version of Formbook malware.
  loader xloader
- Xloader payload
  rat
- Blocklisted process makes network request
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Xloader

Xloader payload

Blocklisted process makes network request

Checks computer location settings

Deletes itself

Adds Run key to start application

Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Tasks

static1

behavioral1

behavioral2