Overview

overview

10

Static

static

1

SecuriteIn...31.exe

windows7-x64

10

SecuriteIn...31.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    SecuriteInfo.com.Win32.PWSX-gen.5291.7831.exe

  • Size

    236KB

  • Sample

    221123-zep9qscf66

  • MD5

    1736339d0f5be6f0fe7504249f514a43

  • SHA1

    6f98fa2f08fa54043eefc8b0715bc1a666457172

  • SHA256

    3a9fc480e92a401646b0b9e69bc8e19946227978764aa497654b4fa78aeb9114

  • SHA512

    4b5cfed8c8a212bb2b06fdeb513dd2d4541ba76edf63c77c108a512feaffea4c56e4153b0cb4c8fede156100b7f5356f02d9ba2c170938d4cd8b53dcb1a70d9c

  • SSDEEP

    6144:QBn1zV8vdcdMGL/+vYm/QZIjFNXQ/enYp:gzCQrLUYm/xFNKenY

Score
10/10
formbookxloaderfqsuloaderratspywarestealertrojan

Malware Config

Extracted

Family

formbook

Campaign

fqsu

Decoy

GhfTqaOqC4FsyoQRW/8=

kbPIpd/8k1C6zJz5mYYdK90ZUA==

VIdg/CoNGeYJHA==

KhzoqndOhw1j43z0ew==

wv8mTDcsX2wJN/Q=

MqBgt6S+3BgGKBQHLZy7Ucg=

GyhOb++nZDi39NPK7dbaKapf

pBtD1UoSTdo3eSp9H7OhRqMV0TAuKMU=

WTzTg1w+fP4fMO0oPPM=

NS/tpGdUwkiMwqmgkxoSzjrQATAuKMU=

MnoSdM1hYn4tdwxjB2fX

3EUfH2EJY17mMf4=

V9/wg2yCQruVszm7V+4=

aNL8pZCGYW4Ej2LD

1Bif9VkmdgVfrJqRvl1GtlTZq1M=

9wHIgmB8EOB2uUVcUfk=

1Fdn15qem+fL1qhrY9xdQmAnVg==

Y32ThttYUUr6PsuRmozlNP74RD+uBz7dOQ==

f5HKyoWNAJLM2qjnZlizsvXDKFs=

mRfaGezap6ZyvJqthZvf

Extracted

Family

xloader

Version

3.8

Campaign

fqsu

Decoy

GhfTqaOqC4FsyoQRW/8=

kbPIpd/8k1C6zJz5mYYdK90ZUA==

VIdg/CoNGeYJHA==

KhzoqndOhw1j43z0ew==

wv8mTDcsX2wJN/Q=

MqBgt6S+3BgGKBQHLZy7Ucg=

GyhOb++nZDi39NPK7dbaKapf

pBtD1UoSTdo3eSp9H7OhRqMV0TAuKMU=

WTzTg1w+fP4fMO0oPPM=

NS/tpGdUwkiMwqmgkxoSzjrQATAuKMU=

MnoSdM1hYn4tdwxjB2fX

3EUfH2EJY17mMf4=

V9/wg2yCQruVszm7V+4=

aNL8pZCGYW4Ej2LD

1Bif9VkmdgVfrJqRvl1GtlTZq1M=

9wHIgmB8EOB2uUVcUfk=

1Fdn15qem+fL1qhrY9xdQmAnVg==

Y32ThttYUUr6PsuRmozlNP74RD+uBz7dOQ==

f5HKyoWNAJLM2qjnZlizsvXDKFs=

mRfaGezap6ZyvJqthZvf

Targets

    • Target

      SecuriteInfo.com.Win32.PWSX-gen.5291.7831.exe

    • Size

      236KB

    • MD5

      1736339d0f5be6f0fe7504249f514a43

    • SHA1

      6f98fa2f08fa54043eefc8b0715bc1a666457172

    • SHA256

      3a9fc480e92a401646b0b9e69bc8e19946227978764aa497654b4fa78aeb9114

    • SHA512

      4b5cfed8c8a212bb2b06fdeb513dd2d4541ba76edf63c77c108a512feaffea4c56e4153b0cb4c8fede156100b7f5356f02d9ba2c170938d4cd8b53dcb1a70d9c

    • SSDEEP

      6144:QBn1zV8vdcdMGL/+vYm/QZIjFNXQ/enYp:gzCQrLUYm/xFNKenY

    Score
    10/10
    formbookfqsuratspywarestealertrojanxloaderloader

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Blocklisted process makes network request

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks