Overview

overview

10

Static

static

44620.exe

windows7-x64

10

44620.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    44620.exe

  • Size

    288KB

  • Sample

    220921-mtd4ssgbd6

  • MD5

    f3cdb6d084eb1476923a99f04b868329

  • SHA1

    943949819b8354ec72c6d7bc2990e60960cc983c

  • SHA256

    53867ae1994d09f07b882ff96d80fc9d38b50e3aae70054985e07b20634ac14f

  • SHA512

    d0d03f489f2163bb3b133bdc42b7b809ba88baeeeebe7541fca3380b59412ba88f87890e78c9fe5fb1398826f303f1d2b3f00e2cf98259a9a018409a7d2a2528

  • SSDEEP

    6144:oQTBRm0/hGz940BNWWCmxKg5VzHUgaRv4w8DX4yyHO3APeyUqhIG:/Q0pKHGKKgzz0gaupYHO8eyUqZ

Score
10/10
formbookxloaderdwdploaderratspywarestealertrojan

Malware Config

Extracted

Family

formbook

Campaign

dwdp

Decoy

jPxWFTS1Rn/K/LD47WRRW7+Veuct8yc=

ke1Wv1l26dZZxDikX9dU3s6k8+w=

+vtNyVBkx8VMf5KCaIj8DYR5QyLJgQ==

GHXPhYzwXcKgZwqBb/kejm7rfobj

yalW64iE8+aXs70=

MD83dBR0KSF4fizgRhAM

Xti3uNm2JDWgssPgRhAM

X7gYbv5uJhpvjdI0Qg==

ydxGznbNJ3tCCLAX4arq4nweMuQ=

Ca+fvtST8OBbosPgRhAM

kG1QegD8mU/E/hLw1t0=

g9FFFjEC5C2IvR/BhbSrpw==

PCkpeg38W0aPdg1rav1DFnVASw==

vSq+xBf3qjY27H3yqepK+g+nOmOMc3m7

G7WYirSZS9EYob8=

WbEWaOVIAPlSNNc4LsfL53weMuQ=

hnyAvEY4n3rTKS4g5mHKxR0=

JN7b0uCqVrQydMl7JNw=

XTki/RASDK6BCW0q8sU=

DQMBWA9wJyOKqqGSmGHKxR0=

Extracted

Family

xloader

Version

3.8

Campaign

dwdp

Decoy

jPxWFTS1Rn/K/LD47WRRW7+Veuct8yc=

ke1Wv1l26dZZxDikX9dU3s6k8+w=

+vtNyVBkx8VMf5KCaIj8DYR5QyLJgQ==

GHXPhYzwXcKgZwqBb/kejm7rfobj

yalW64iE8+aXs70=

MD83dBR0KSF4fizgRhAM

Xti3uNm2JDWgssPgRhAM

X7gYbv5uJhpvjdI0Qg==

ydxGznbNJ3tCCLAX4arq4nweMuQ=

Ca+fvtST8OBbosPgRhAM

kG1QegD8mU/E/hLw1t0=

g9FFFjEC5C2IvR/BhbSrpw==

PCkpeg38W0aPdg1rav1DFnVASw==

vSq+xBf3qjY27H3yqepK+g+nOmOMc3m7

G7WYirSZS9EYob8=

WbEWaOVIAPlSNNc4LsfL53weMuQ=

hnyAvEY4n3rTKS4g5mHKxR0=

JN7b0uCqVrQydMl7JNw=

XTki/RASDK6BCW0q8sU=

DQMBWA9wJyOKqqGSmGHKxR0=

Targets

    • Target

      44620.exe

    • Size

      288KB

    • MD5

      f3cdb6d084eb1476923a99f04b868329

    • SHA1

      943949819b8354ec72c6d7bc2990e60960cc983c

    • SHA256

      53867ae1994d09f07b882ff96d80fc9d38b50e3aae70054985e07b20634ac14f

    • SHA512

      d0d03f489f2163bb3b133bdc42b7b809ba88baeeeebe7541fca3380b59412ba88f87890e78c9fe5fb1398826f303f1d2b3f00e2cf98259a9a018409a7d2a2528

    • SSDEEP

      6144:oQTBRm0/hGz940BNWWCmxKg5VzHUgaRv4w8DX4yyHO3APeyUqhIG:/Q0pKHGKKgzz0gaupYHO8eyUqZ

    Score
    10/10
    formbookxloaderdwdploaderratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks