Overview

overview

10

Static

static

Purchase_Order.exe

windows7-x64

10

Purchase_Order.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e5b77a8ea23b6ae181b4d15c7da045c7

  • Size

    372KB

  • Sample

    220929-xaamdacffp

  • MD5

    e5b77a8ea23b6ae181b4d15c7da045c7

  • SHA1

    c0d45afa26fe7ed023d0f6eb7736648c2847bf0a

  • SHA256

    c67e6090d84532946ce00c79f918ea4733cd96b9ccb5dab54c0e0e2eeafb9cf9

  • SHA512

    76f773310f04fcb4c7793fdf6f984d9495f4866bb08695df2d8900b3770a26ee4683f6c54abae8b49797f01cbf724d00544984482a06192b8db75c1285c294e9

  • SSDEEP

    6144:hnhd8sDUkM6CX1DWGwHKGhL3uq287K6X+yYPlweGPcrLRzP/EcL8K5NXY+zg:p/8sRMvFXwHK2xOBPmeiMFnEk8t+zg

Score
10/10
formbookxloaderi65aloaderratspywarestealertrojan

Malware Config

Extracted

Family

formbook

Campaign

i65a

Decoy

r00zzvD9uoqMkFT8XDSqPg==

iSMQDJ3Tyuj8KXflBw==

Gq+tYoFrGU/5B4gGNnzHNg==

wEwcynSwpynZKUFhqyIK

bw3PbrjowhAVJA==

TggEt9LuwhAVJA==

r0UqC6sxgcWN7vc=

0m+fwBgf0oyehByUtx51BsBkuj8=

dhtdWWyIhRatp2dpv8tPcJoQ

jTAw4/4TCwcXjpECXDSqPg==

aglx4nPPkGp/raeivGVOfzdbFIu4

+qXr4cAGtQJm7Mf6

sU2Dc4ySSKZJc2/L32pFRrq+NgA0Yi8=

E6ohOo2zadVgzLIfaWALaik=

wXwu0yo/KbNm7Mf6

EcoyojCJYKg1laCuBK+exkNbFIu4

bhZgFvj6yP+R4F+0/5S/oFMpAA==

rzlylCB1NIMabG2dzGQd

+5ngCKjwwhAVJA==

AMUtZrYh+0LPL/QyfSo=

Extracted

Family

xloader

Version

3.8

Campaign

i65a

Decoy

r00zzvD9uoqMkFT8XDSqPg==

iSMQDJ3Tyuj8KXflBw==

Gq+tYoFrGU/5B4gGNnzHNg==

wEwcynSwpynZKUFhqyIK

bw3PbrjowhAVJA==

TggEt9LuwhAVJA==

r0UqC6sxgcWN7vc=

0m+fwBgf0oyehByUtx51BsBkuj8=

dhtdWWyIhRatp2dpv8tPcJoQ

jTAw4/4TCwcXjpECXDSqPg==

aglx4nPPkGp/raeivGVOfzdbFIu4

+qXr4cAGtQJm7Mf6

sU2Dc4ySSKZJc2/L32pFRrq+NgA0Yi8=

E6ohOo2zadVgzLIfaWALaik=

wXwu0yo/KbNm7Mf6

EcoyojCJYKg1laCuBK+exkNbFIu4

bhZgFvj6yP+R4F+0/5S/oFMpAA==

rzlylCB1NIMabG2dzGQd

+5ngCKjwwhAVJA==

AMUtZrYh+0LPL/QyfSo=

Targets

    • Target

      Purchase_Order.exe

    • Size

      460KB

    • MD5

      3b5056e4430804872a253c034ac9ca47

    • SHA1

      2b0942b8aa1615a5d8c61326a3c88fa4d0658e09

    • SHA256

      f468e0e25debea49005582be9279616ee2f100a73cbedaaecebdc210a5515102

    • SHA512

      993b3511e6fa766b85418b2fc69ab921f8a51f377b3ca6a6caf818eaea9e6e90f26135c5dd89d76676b743d75f99a6d0d9c98942d16c522133e629a1484af3c3

    • SSDEEP

      6144:j246z2kJ7ZM3X2a2gIi9pGB9o2L3v+1LqtOLzqTEogLXax:j246zrTMqi9EB9oU21LqtrETX

    Score
    10/10
    formbooki65aratspywarestealertrojanxloaderloader

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Command-Line Interface

1
T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks