Overview

overview

10

Static

static

Purchase_Order.exe

windows7-x64

10

Purchase_Order.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    11e5cb9400e21fdbec94d9426b62b195

  • Size

    349KB

  • Sample

    220927-yzbfmsfeel

  • MD5

    11e5cb9400e21fdbec94d9426b62b195

  • SHA1

    5e4621dc8395a48a222dc1ae1b9c06b1f8761f3e

  • SHA256

    03d09daf29b330a572c8c5e6dcb96bfd08c9494ff2908a8b1570e5fef7bea72e

  • SHA512

    44af0d9b441a610abc143c3709ca4fe7745fab370f4858be388aeb6a03d17e892d0816db509140ecc166364df80b6700b8840fdfb61d343c6f3bc5755422581c

  • SSDEEP

    6144:2vI/pos9fi9lOc5l9g3PWgxVvf4g4AlKhmT/Yq97IQURj1L+tQaNixyN:2w/tg4wlm3jxVvf4gvlKhmT/rULmQag0

Score
10/10
formbookxloaderi65aloaderratspywarestealertrojan

Malware Config

Extracted

Family

formbook

Campaign

i65a

Decoy

r00zzvD9uoqMkFT8XDSqPg==

iSMQDJ3Tyuj8KXflBw==

Gq+tYoFrGU/5B4gGNnzHNg==

wEwcynSwpynZKUFhqyIK

bw3PbrjowhAVJA==

TggEt9LuwhAVJA==

r0UqC6sxgcWN7vc=

0m+fwBgf0oyehByUtx51BsBkuj8=

dhtdWWyIhRatp2dpv8tPcJoQ

jTAw4/4TCwcXjpECXDSqPg==

aglx4nPPkGp/raeivGVOfzdbFIu4

+qXr4cAGtQJm7Mf6

sU2Dc4ySSKZJc2/L32pFRrq+NgA0Yi8=

E6ohOo2zadVgzLIfaWALaik=

wXwu0yo/KbNm7Mf6

EcoyojCJYKg1laCuBK+exkNbFIu4

bhZgFvj6yP+R4F+0/5S/oFMpAA==

rzlylCB1NIMabG2dzGQd

+5ngCKjwwhAVJA==

AMUtZrYh+0LPL/QyfSo=

Extracted

Family

xloader

Version

3.8

Campaign

i65a

Decoy

r00zzvD9uoqMkFT8XDSqPg==

iSMQDJ3Tyuj8KXflBw==

Gq+tYoFrGU/5B4gGNnzHNg==

wEwcynSwpynZKUFhqyIK

bw3PbrjowhAVJA==

TggEt9LuwhAVJA==

r0UqC6sxgcWN7vc=

0m+fwBgf0oyehByUtx51BsBkuj8=

dhtdWWyIhRatp2dpv8tPcJoQ

jTAw4/4TCwcXjpECXDSqPg==

aglx4nPPkGp/raeivGVOfzdbFIu4

+qXr4cAGtQJm7Mf6

sU2Dc4ySSKZJc2/L32pFRrq+NgA0Yi8=

E6ohOo2zadVgzLIfaWALaik=

wXwu0yo/KbNm7Mf6

EcoyojCJYKg1laCuBK+exkNbFIu4

bhZgFvj6yP+R4F+0/5S/oFMpAA==

rzlylCB1NIMabG2dzGQd

+5ngCKjwwhAVJA==

AMUtZrYh+0LPL/QyfSo=

Targets

    • Target

      Purchase_Order.exe

    • Size

      295KB

    • MD5

      4e256d3d4ddbcc9c1d2cfa57034a0d52

    • SHA1

      60ec184a1ab03af29341f093791e210202814f1c

    • SHA256

      5463db9a5e180df75642646615cfd6ff7598b9846718c2224f19c878ee01dc00

    • SHA512

      2e455bd66870778fc511515d3db4ae3b14d16374436cc4f6b70c182b42f2c70f977b9976194c1fb392f0ab28ebc4b7fd3ecec87fba279a541c6be396425fd79e

    • SSDEEP

      6144:uj5zFdfKy5i+xc+tR5VwWmKH0LYlA8yjXeIIzls3GEioll+8zE7ev:efKy5p9tBmKUL0uhIoGEiQltEi

    Score
    10/10
    formbookxloaderi65aloaderratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks