Overview

overview

10

Static

static

Purchase_Order.exe

windows7-x64

10

Purchase_Order.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Purchase_Order.exe

  • Size

    298KB

  • Sample

    221003-hsnvdsdhck

  • MD5

    bbb57513bb805fcb3ef1ae2391471599

  • SHA1

    66c7d14b225a33b350e6f67a38d083ae019b4169

  • SHA256

    f3d069895a8e65723f90f6ea33a53b6b30cdb20a613ae18292780f610eccd03e

  • SHA512

    26e427a38cff46ba25d5b71c82c4ead15cb7f50c1f2ed4ba4f86ae7c42d8af6b91de3c16521d25c56033735ae1ef64d1d80a5c66c2cafcef20552a1576c1531e

  • SSDEEP

    6144:Ze7CeGzLGQ6pFxwXP1Rtg6il224AAUr2A1wdkKhaTMiM:euzLGQ6eXP1Rtv24AhLG1

Score
10/10
formbookxloaderi65aloaderratspywarestealertrojan

Malware Config

Extracted

Family

formbook

Campaign

i65a

Decoy

r00zzvD9uoqMkFT8XDSqPg==

iSMQDJ3Tyuj8KXflBw==

Gq+tYoFrGU/5B4gGNnzHNg==

wEwcynSwpynZKUFhqyIK

bw3PbrjowhAVJA==

TggEt9LuwhAVJA==

r0UqC6sxgcWN7vc=

0m+fwBgf0oyehByUtx51BsBkuj8=

dhtdWWyIhRatp2dpv8tPcJoQ

jTAw4/4TCwcXjpECXDSqPg==

aglx4nPPkGp/raeivGVOfzdbFIu4

+qXr4cAGtQJm7Mf6

sU2Dc4ySSKZJc2/L32pFRrq+NgA0Yi8=

E6ohOo2zadVgzLIfaWALaik=

wXwu0yo/KbNm7Mf6

EcoyojCJYKg1laCuBK+exkNbFIu4

bhZgFvj6yP+R4F+0/5S/oFMpAA==

rzlylCB1NIMabG2dzGQd

+5ngCKjwwhAVJA==

AMUtZrYh+0LPL/QyfSo=

Extracted

Family

xloader

Version

3.8

Campaign

i65a

Decoy

r00zzvD9uoqMkFT8XDSqPg==

iSMQDJ3Tyuj8KXflBw==

Gq+tYoFrGU/5B4gGNnzHNg==

wEwcynSwpynZKUFhqyIK

bw3PbrjowhAVJA==

TggEt9LuwhAVJA==

r0UqC6sxgcWN7vc=

0m+fwBgf0oyehByUtx51BsBkuj8=

dhtdWWyIhRatp2dpv8tPcJoQ

jTAw4/4TCwcXjpECXDSqPg==

aglx4nPPkGp/raeivGVOfzdbFIu4

+qXr4cAGtQJm7Mf6

sU2Dc4ySSKZJc2/L32pFRrq+NgA0Yi8=

E6ohOo2zadVgzLIfaWALaik=

wXwu0yo/KbNm7Mf6

EcoyojCJYKg1laCuBK+exkNbFIu4

bhZgFvj6yP+R4F+0/5S/oFMpAA==

rzlylCB1NIMabG2dzGQd

+5ngCKjwwhAVJA==

AMUtZrYh+0LPL/QyfSo=

Targets

    • Target

      Purchase_Order.exe

    • Size

      298KB

    • MD5

      bbb57513bb805fcb3ef1ae2391471599

    • SHA1

      66c7d14b225a33b350e6f67a38d083ae019b4169

    • SHA256

      f3d069895a8e65723f90f6ea33a53b6b30cdb20a613ae18292780f610eccd03e

    • SHA512

      26e427a38cff46ba25d5b71c82c4ead15cb7f50c1f2ed4ba4f86ae7c42d8af6b91de3c16521d25c56033735ae1ef64d1d80a5c66c2cafcef20552a1576c1531e

    • SSDEEP

      6144:Ze7CeGzLGQ6pFxwXP1Rtg6il224AAUr2A1wdkKhaTMiM:euzLGQ6eXP1Rtv24AhLG1

    Score
    10/10
    formbookxloaderi65aloaderratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks