formbook

Sharing

Copy URL Twitter E-mail

General

Target
Ziraat Bankasi Swift Mesaji20221109 (2).exe
Size 724KB
Sample221109-t91q3aaeb7
SHA256 be9a528e67d3bf2dcd7acaaace72825a8702f13c39314499a839713c1cdd7cc9
MD5 d0794f66bdddd95a963fb82dbbcb68cd
SHA1 e04ac0956c62ff97e78f9a0af7cd3970b6b62e0f
SHA512 92cc41e4568c389aeddf3ed25a6c82b65dc1ed30148616fd09c00fcd49073574ae2fa62f3eebcf91e80beb6053c27d36016310d8d76ac6a728c214f15968a484
SSDEEP 12288:gqi6IXPod2iNnNrwEWfs3qJtO3BVThiUH7JgrrCyn9+9OLRD39oo3F5/W+:gEd1LkE3qT2BVTk7qy9+9OdD3io3F93
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

formbook

Campaign

qmpa

Decoy

IEiN8oqOnNUEkfZd
LWyAr1P5PHPV
tMGP9gYCIc9DKQ==
fWi2stCh2E3DBWuEK612
B3LCCi2JvPxfNA==
NjLnNjX+DDWt/VuEK612
AvK5/JdMDLztPRg=
U+zn2FswDLztPRg=
3bRIXGwsIc9DKQ==
EXmAoj3/7Cyl+VuEK612
1gkKPklP1odxx7c/Zm+L6HeV4g==
1cMaHDg0ypV0vbT2Ibh+/5Cj5xmAVxA=
MSyBdIV+6nFRloTQAwmFklQ=
qilszGJvhMUsHgaUx/MNSKuo6A==
WYKLwmYEij4q2Hy6sOc=
sjII/IyFmORBFPJ2dVjpG0Q=
mTjzaRwZ9OsEkfZd
iL27vFhbX5ECbBIJxvJKbPHFf9M=
5A5Xr0D5PHPV
IpxsaTO4a1/I
O0akl/OtJu4=
W/Uo1VYpCLztPRg=
TxppXmMgUNC7BQOgzfIMSKuo6A==
R9Qsn1NYXIn0L9fTueU=
O5nTCTAIUYiqFQU=
qUA5LcysmdcEkfZd
jzY2a8iJvPxfNA==
G3Sjzt+b4lfVJo/AOp24sw==
pXEEKkfNMVnK
S6Cz2nc10oNrsJ0P+fA6jH48paMTEw==
sIDiCIeUrOAEkfZd
wKQkm/9lVVnI
uiIfKsOIQjwn8J2V5J1r
zHF4c+ypQ7ztPRg=
KwzbHrpTv3laKtfTueU=
k6JZiCC1KtFSIwiZk47UDt64Yss=
2fLFESoxpllKl5KxYXiW9toW+3DhXwE=
7VAnHMvgw84gTPYPyw==
ArIxekAPMmnRInupMqXfEUA=
ASdaAujYAQRRPg==
4h0THru60PsqyyGCBax+
6Ko6ZoljwEKxwljcDEOZuw==
gjO1ys5bRoj94slTOp24sw==
x4IVLlJKz4x/ybAzVoWSTt64Yss=
ilPsNVL6IaVE0bkfc+w=
wCKB0/SQg704jfUv3/wSSKuo6A==
+eR0tEZJMepVMA==
U42K55D5PHPV
goRIp7OCvDSpg20JCAE/rGT6/w==
2SoyM+br3hJySS1aDQoQZXe784VlUAU=
4LE7N1ZjxDsdfXYAGAzoUV0=
Z9D0XXcxIc9DKQ==
50BLU/bJfGFWsqJD76Yrr3H8
bHozX/y2emhZnX/3FxMQSKuo6A==
ETn+luu5Ugm4IkmeMBDfTcUDByHHFQ==
DWeErEUN29PLqCBSde+C6Z21HgbBWAkLRA==
ervK+g4HIc9DKQ==
/eaqAhTqH4X/5bEhHgzoUV0=
JUtMz3n5PHPV
LT8KV/+eGcivBfE8HwzoUV0=
/xyfrdbaaSMUdmW3/qcrr3H8
ZgQYKcKUKOPQtBidD5krr3H8
Qcd6yWA3xM1ftS1xI/t/BPCeS8M=
nmDfwNfXAQRRPg==
erwgcb.top

Extracted

Family

xloader

Version

3.ƅ

Campaign

qmpa

Decoy

IEiN8oqOnNUEkfZd
LWyAr1P5PHPV
tMGP9gYCIc9DKQ==
fWi2stCh2E3DBWuEK612
B3LCCi2JvPxfNA==
NjLnNjX+DDWt/VuEK612
AvK5/JdMDLztPRg=
U+zn2FswDLztPRg=
3bRIXGwsIc9DKQ==
EXmAoj3/7Cyl+VuEK612
1gkKPklP1odxx7c/Zm+L6HeV4g==
1cMaHDg0ypV0vbT2Ibh+/5Cj5xmAVxA=
MSyBdIV+6nFRloTQAwmFklQ=
qilszGJvhMUsHgaUx/MNSKuo6A==
WYKLwmYEij4q2Hy6sOc=
sjII/IyFmORBFPJ2dVjpG0Q=
mTjzaRwZ9OsEkfZd
iL27vFhbX5ECbBIJxvJKbPHFf9M=
5A5Xr0D5PHPV
IpxsaTO4a1/I
O0akl/OtJu4=
W/Uo1VYpCLztPRg=
TxppXmMgUNC7BQOgzfIMSKuo6A==
R9Qsn1NYXIn0L9fTueU=
O5nTCTAIUYiqFQU=
qUA5LcysmdcEkfZd
jzY2a8iJvPxfNA==
G3Sjzt+b4lfVJo/AOp24sw==
pXEEKkfNMVnK
S6Cz2nc10oNrsJ0P+fA6jH48paMTEw==
sIDiCIeUrOAEkfZd
wKQkm/9lVVnI
uiIfKsOIQjwn8J2V5J1r
zHF4c+ypQ7ztPRg=
KwzbHrpTv3laKtfTueU=
k6JZiCC1KtFSIwiZk47UDt64Yss=
2fLFESoxpllKl5KxYXiW9toW+3DhXwE=
7VAnHMvgw84gTPYPyw==
ArIxekAPMmnRInupMqXfEUA=
ASdaAujYAQRRPg==
4h0THru60PsqyyGCBax+
6Ko6ZoljwEKxwljcDEOZuw==
gjO1ys5bRoj94slTOp24sw==
x4IVLlJKz4x/ybAzVoWSTt64Yss=
ilPsNVL6IaVE0bkfc+w=
wCKB0/SQg704jfUv3/wSSKuo6A==
+eR0tEZJMepVMA==
U42K55D5PHPV
goRIp7OCvDSpg20JCAE/rGT6/w==
2SoyM+br3hJySS1aDQoQZXe784VlUAU=
4LE7N1ZjxDsdfXYAGAzoUV0=
Z9D0XXcxIc9DKQ==
50BLU/bJfGFWsqJD76Yrr3H8
bHozX/y2emhZnX/3FxMQSKuo6A==
ETn+luu5Ugm4IkmeMBDfTcUDByHHFQ==
DWeErEUN29PLqCBSde+C6Z21HgbBWAkLRA==
ervK+g4HIc9DKQ==
/eaqAhTqH4X/5bEhHgzoUV0=
JUtMz3n5PHPV
LT8KV/+eGcivBfE8HwzoUV0=
/xyfrdbaaSMUdmW3/qcrr3H8
ZgQYKcKUKOPQtBidD5krr3H8
Qcd6yWA3xM1ftS1xI/t/BPCeS8M=
nmDfwNfXAQRRPg==
erwgcb.top

Targets

- Target
  Ziraat Bankasi Swift Mesaji20221109 (2).exe
- Size 724KB
- SHA256 be9a528e67d3bf2dcd7acaaace72825a8702f13c39314499a839713c1cdd7cc9
- MD5 d0794f66bdddd95a963fb82dbbcb68cd
- SHA1 e04ac0956c62ff97e78f9a0af7cd3970b6b62e0f
- SHA512 92cc41e4568c389aeddf3ed25a6c82b65dc1ed30148616fd09c00fcd49073574ae2fa62f3eebcf91e80beb6053c27d36016310d8d76ac6a728c214f15968a484
- SSDEEP 12288:gqi6IXPod2iNnNrwEWfs3qJtO3BVThiUH7JgrrCyn9+9OLRD39oo3F5/W+:gEd1LkE3qT2BVTk7qy9+9OdD3io3F93
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

formbook xloader qmpa loader rat spyware stealer trojan
- Formbook
  Formbook is a data stealing malware which is capable of stealing data.
  trojan spyware stealer formbook
- Xloader
  Xloader is a rebranded version of Formbook malware.
  loader xloader
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Command-Line Interface

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Targets

Xloader

Checks computer location settings

Loads dropped DLL

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2