Overview

overview

10

Static

static

SecuriteIn...en.exe

windows7-x64

10

SecuriteIn...en.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    SecuriteInfo.com.Win32.PWSX-gen.8811

  • Size

    461KB

  • Sample

    220928-j4e73agebm

  • MD5

    967c83d3b836283648ededfd6deccbb2

  • SHA1

    05d0066d85b7a3396f0ba3aa3860b4b188706df4

  • SHA256

    364f5cfc6c99c0b408090af7528505844b1b33853c5ea7930420d8f11b4ca011

  • SHA512

    2db5a17e6130c9c0746b1d0f8d8cc34352c3d01e02de02468de4d818808fd7a8357bf95e3e0184bb4997d599342cd7d21190f1b427cb6ad525690b2ec4389085

  • SSDEEP

    6144:erJQS6I+8yxiQQ7i7w1vWwk1agfIHDK+C0nY8kEaRMva+:erJQS6I+8yxiQQ7ZoH1acaHdY/EaRMv

Score
10/10
formbookxloaderi3twloaderratspywarestealertrojan

Malware Config

Extracted

Family

formbook

Campaign

i3tw

Decoy

016XYOaa546POq6CaRVpEfQ=

6WCLUcRz6K7qTqIK

bIa/9uWTepQa6eQd

32urdxWXgrknUIeDYktb

EojfLVA0GyB2mYgMgzdT

jFbHYJhPwpebnHjAY0pZ

gxSusEwA30uVtrErCrQ=

EeJOmOn63OaCHIw=

r3K0jTvKtOR4EV3q1dOdHgYVCLVG

6LEakplWzoSSLXZH3t6XDQ==

MThmlLavncxvAo1f3t6XDQ==

SqUmLs+BeJfa69kp7qSmIfuU5K3ZMg==

GuIYfF0o7zGPJY4=

AEd4Wd7JRsdzBX9dPgO7KNJY6NX2Sga4

E1SDU8MxGoZaPFgn9w==

cIq96QyWC/k1XDBRTR9FQOaLosd4Og==

/zRZMuaxmZnX291wZQCXhiq1his=

+47IMmwvk2jyx7MA

IGKz6DH4iraNLQ==

Kh1gHpxbw0MDkwSyaOqjKgTlK69R

Extracted

Family

xloader

Version

3.8

Campaign

i3tw

Decoy

016XYOaa546POq6CaRVpEfQ=

6WCLUcRz6K7qTqIK

bIa/9uWTepQa6eQd

32urdxWXgrknUIeDYktb

EojfLVA0GyB2mYgMgzdT

jFbHYJhPwpebnHjAY0pZ

gxSusEwA30uVtrErCrQ=

EeJOmOn63OaCHIw=

r3K0jTvKtOR4EV3q1dOdHgYVCLVG

6LEakplWzoSSLXZH3t6XDQ==

MThmlLavncxvAo1f3t6XDQ==

SqUmLs+BeJfa69kp7qSmIfuU5K3ZMg==

GuIYfF0o7zGPJY4=

AEd4Wd7JRsdzBX9dPgO7KNJY6NX2Sga4

E1SDU8MxGoZaPFgn9w==

cIq96QyWC/k1XDBRTR9FQOaLosd4Og==

/zRZMuaxmZnX291wZQCXhiq1his=

+47IMmwvk2jyx7MA

IGKz6DH4iraNLQ==

Kh1gHpxbw0MDkwSyaOqjKgTlK69R

Targets

    • Target

      SecuriteInfo.com.Win32.PWSX-gen.8811

    • Size

      461KB

    • MD5

      967c83d3b836283648ededfd6deccbb2

    • SHA1

      05d0066d85b7a3396f0ba3aa3860b4b188706df4

    • SHA256

      364f5cfc6c99c0b408090af7528505844b1b33853c5ea7930420d8f11b4ca011

    • SHA512

      2db5a17e6130c9c0746b1d0f8d8cc34352c3d01e02de02468de4d818808fd7a8357bf95e3e0184bb4997d599342cd7d21190f1b427cb6ad525690b2ec4389085

    • SSDEEP

      6144:erJQS6I+8yxiQQ7i7w1vWwk1agfIHDK+C0nY8kEaRMva+:erJQS6I+8yxiQQ7ZoH1acaHdY/EaRMv

    Score
    10/10
    formbooki3twratspywarestealertrojanxloaderloader

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Blocklisted process makes network request

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks