Overview

overview

10

Static

static

yxrp7aBc7KHBCsk.exe

windows7-x64

10

yxrp7aBc7KHBCsk.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    yxrp7aBc7KHBCsk.exe

  • Size

    1.1MB

  • Sample

    221004-ke3gqsafbm

  • MD5

    48ab3af9d46affb38d6bba63215f606f

  • SHA1

    5a5f9ddc5cf46787a03c8cefe1c038274b69f2eb

  • SHA256

    0b064f0ef5c1fc97add6a750c3166edc03d6ebbcf0ed5b0e36cec598ff2e301e

  • SHA512

    7eea0bfbd69f74003a5a24c6ae9cfcb13321454e932bee8026a6ef636e5ad9750aff3b081b6f3bd031578c600df9e3e2a6f0122551540aa23f5ec174bae33647

  • SSDEEP

    24576:0ufO+8zjZ1dSvam6fNgyDh1u7hDi7hdqkMzjVfr:nz8zjZbSz6Vy7UT5OJfr

Score
10/10
formbookxloadercqd8loaderratspywarestealertrojan

Malware Config

Extracted

Family

formbook

Campaign

cqd8

Decoy

9zPItsSBQPthH0B1

iyz2ugC7TUMEaZEDDTNIzw==

uVc25zCFO03zbYzHxXLElk5HHccFoes=

RYDZw1su7yszucXjwqtgrz1tSccFoes=

AiB+KfBdDLRFs8sOAsmAllKZeg==

w5T7/Y1lNGBeMdKkKNl8tUl3fTWjlURG

mcIHqPCaEavSyg==

YA7dyN6xKf1MKJa/RA==

Dt789IRVd/fO8FeQNOiV3g==

jYfu3dS4b/1OL59exnPPEo4=

SjyOSKD6lRhpWwUmMwE8ncB1KOg=

JIT782/TaO41DXw3hYJa1g==

uT4u7SwA+3yA/iCo0O7tHyeffA==

/gJzPfngDySzwndmyHPPEo4=

+Um8wD7b9bCQ8A9cK4Nl1oA=

RaikVqx5ozxW3vd6khgIHsDMgKrv

hyYEyRMIEJ8WdnFePeLgHyeffA==

bCov6raFJ30odm5fJQQ=

1rMMrXrTf7OZqyLVM708wZ0=

U4nspOC6sJ3et2I=

Extracted

Family

xloader

Version

3.8

Campaign

cqd8

Decoy

9zPItsSBQPthH0B1

iyz2ugC7TUMEaZEDDTNIzw==

uVc25zCFO03zbYzHxXLElk5HHccFoes=

RYDZw1su7yszucXjwqtgrz1tSccFoes=

AiB+KfBdDLRFs8sOAsmAllKZeg==

w5T7/Y1lNGBeMdKkKNl8tUl3fTWjlURG

mcIHqPCaEavSyg==

YA7dyN6xKf1MKJa/RA==

Dt789IRVd/fO8FeQNOiV3g==

jYfu3dS4b/1OL59exnPPEo4=

SjyOSKD6lRhpWwUmMwE8ncB1KOg=

JIT782/TaO41DXw3hYJa1g==

uT4u7SwA+3yA/iCo0O7tHyeffA==

/gJzPfngDySzwndmyHPPEo4=

+Um8wD7b9bCQ8A9cK4Nl1oA=

RaikVqx5ozxW3vd6khgIHsDMgKrv

hyYEyRMIEJ8WdnFePeLgHyeffA==

bCov6raFJ30odm5fJQQ=

1rMMrXrTf7OZqyLVM708wZ0=

U4nspOC6sJ3et2I=

Targets

    • Target

      yxrp7aBc7KHBCsk.exe

    • Size

      1.1MB

    • MD5

      48ab3af9d46affb38d6bba63215f606f

    • SHA1

      5a5f9ddc5cf46787a03c8cefe1c038274b69f2eb

    • SHA256

      0b064f0ef5c1fc97add6a750c3166edc03d6ebbcf0ed5b0e36cec598ff2e301e

    • SHA512

      7eea0bfbd69f74003a5a24c6ae9cfcb13321454e932bee8026a6ef636e5ad9750aff3b081b6f3bd031578c600df9e3e2a6f0122551540aa23f5ec174bae33647

    • SSDEEP

      24576:0ufO+8zjZ1dSvam6fNgyDh1u7hDi7hdqkMzjVfr:nz8zjZbSz6Vy7UT5OJfr

    Score
    10/10
    formbookxloadercqd8loaderratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Blocklisted process makes network request

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks