Overview

overview

10

Static

static

5198666532...b8.exe

windows7-x64

10

5198666532...b8.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    51986665322a79945ae565a363862e8007b3be459855f27c11c062da0eb59db8.exe

  • Size

    479KB

  • Sample

    221010-p4mj2abgh2

  • MD5

    c785cff5261dc195e6acaff0f814e57b

  • SHA1

    4a529517826527076af2e7049dbb3b8cb89dcc4c

  • SHA256

    51986665322a79945ae565a363862e8007b3be459855f27c11c062da0eb59db8

  • SHA512

    a1d1b0432cb1842fecba8d5ffb27658ae880cb20786bfe76a959357840b6f23d8e0657dc73b7ea9158adfbaf6468ee24c4574f64d2c152a468ca681b52bb6baa

  • SSDEEP

    6144:lTouKrWBEu3/Z2lpGDHU3ykJ1tC/IH0woLZHLjh4rEEPHDUrllFS+yd:lToPWBv/cpGrU3y8tGE0lLx2rEMjOF+

Score
10/10
formbookxloaderu8owloaderpersistenceratspywarestealertrojan

Malware Config

Extracted

Family

formbook

Campaign

u8ow

Decoy

uzhDDUNgg10rOh8rkUMGYiLuNnRWl9gwMQ==

bfkA4IUaSgYi7IA=

ezX5yHeR21O3h2RCgQ==

x3E4ntHeLMGQm0kdTi6PJtjOVS6Em8UaKA==

xJuAYwcZLAfqrVazWjvkirgFxDSf

qrGugLdannLYegX5dCtFMA==

i61nMddueAYi7IA=

RoNMKNhtdDWpeiYoaB37TPiHTLo=

RFj3UHHrDtAktSZhYku36opnsaMbNA==

lx0g+6RPl4jwwNPRPuTD

MyEQ4oGk6vXrMM4V

0IVWH0rfKe1J4nn6J9XB

SYVlN3Zrnq2OaWpDiQ==

fNa0jy3P8KQK25rpmwqd0t8=

UZuSZpW+9ffX9KXzmgqd0t8=

Vxf85YCWvYNZjkcDdCtFMA==

0gG1EzLP7/DrMM4V

WExRGVAEE6YS5tJkTxMhR636+A==

6Tv7U4QdURt1KUI+gw==

ooR7RXgsXPtaEutnaQ3efjIXmfJePavzIA==

Targets

    • Target

      51986665322a79945ae565a363862e8007b3be459855f27c11c062da0eb59db8.exe

    • Size

      479KB

    • MD5

      c785cff5261dc195e6acaff0f814e57b

    • SHA1

      4a529517826527076af2e7049dbb3b8cb89dcc4c

    • SHA256

      51986665322a79945ae565a363862e8007b3be459855f27c11c062da0eb59db8

    • SHA512

      a1d1b0432cb1842fecba8d5ffb27658ae880cb20786bfe76a959357840b6f23d8e0657dc73b7ea9158adfbaf6468ee24c4574f64d2c152a468ca681b52bb6baa

    • SSDEEP

      6144:lTouKrWBEu3/Z2lpGDHU3ykJ1tC/IH0woLZHLjh4rEEPHDUrllFS+yd:lToPWBv/cpGrU3y8tGE0lLx2rEMjOF+

    Score
    10/10
    formbookxloaderu8owloaderpersistenceratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader payload

      rat

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks