Overview

overview

10

Static

static

1

Facture.exe

windows7-x64

10

Facture.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Facture.exe

  • Size

    236KB

  • Sample

    221201-mat1xahb58

  • MD5

    eccee50ed45d206ba3c2e75dac5607b8

  • SHA1

    131af9283a990d7dd801609b81c6e1641696bb6a

  • SHA256

    344ae4ecfec1e2a0ca7c2e6b970f077cf55fd1c7cbe41d8963b83848ccf0b229

  • SHA512

    1b1754c5c463991a5e2f33723cd8ae7c51cdd9d1b2040b5481376e302fd9738b2dd32c3272a65e6d20cc2d171e90eb5f7a0346d3fea6b7b33a6159c18673ea99

  • SSDEEP

    3072:QEhKzShSycSMv/jXTahrEOJHMSRRYFFg0pOGTX4oDJEHbRdcumx1u8bTOtHRKqZH:QBn1vcrESHTRYj9FTfUj8D8QqZFrBIp4

Score
10/10
formbookxloaderfqsuloaderratspywarestealertrojan

Malware Config

Extracted

Family

formbook

Campaign

fqsu

Decoy

GhfTqaOqC4FsyoQRW/8=

kbPIpd/8k1C6zJz5mYYdK90ZUA==

VIdg/CoNGeYJHA==

KhzoqndOhw1j43z0ew==

wv8mTDcsX2wJN/Q=

MqBgt6S+3BgGKBQHLZy7Ucg=

GyhOb++nZDi39NPK7dbaKapf

pBtD1UoSTdo3eSp9H7OhRqMV0TAuKMU=

WTzTg1w+fP4fMO0oPPM=

NS/tpGdUwkiMwqmgkxoSzjrQATAuKMU=

MnoSdM1hYn4tdwxjB2fX

3EUfH2EJY17mMf4=

V9/wg2yCQruVszm7V+4=

aNL8pZCGYW4Ej2LD

1Bif9VkmdgVfrJqRvl1GtlTZq1M=

9wHIgmB8EOB2uUVcUfk=

1Fdn15qem+fL1qhrY9xdQmAnVg==

Y32ThttYUUr6PsuRmozlNP74RD+uBz7dOQ==

f5HKyoWNAJLM2qjnZlizsvXDKFs=

mRfaGezap6ZyvJqthZvf

Extracted

Family

xloader

Version

3.8

Campaign

fqsu

Decoy

GhfTqaOqC4FsyoQRW/8=

kbPIpd/8k1C6zJz5mYYdK90ZUA==

VIdg/CoNGeYJHA==

KhzoqndOhw1j43z0ew==

wv8mTDcsX2wJN/Q=

MqBgt6S+3BgGKBQHLZy7Ucg=

GyhOb++nZDi39NPK7dbaKapf

pBtD1UoSTdo3eSp9H7OhRqMV0TAuKMU=

WTzTg1w+fP4fMO0oPPM=

NS/tpGdUwkiMwqmgkxoSzjrQATAuKMU=

MnoSdM1hYn4tdwxjB2fX

3EUfH2EJY17mMf4=

V9/wg2yCQruVszm7V+4=

aNL8pZCGYW4Ej2LD

1Bif9VkmdgVfrJqRvl1GtlTZq1M=

9wHIgmB8EOB2uUVcUfk=

1Fdn15qem+fL1qhrY9xdQmAnVg==

Y32ThttYUUr6PsuRmozlNP74RD+uBz7dOQ==

f5HKyoWNAJLM2qjnZlizsvXDKFs=

mRfaGezap6ZyvJqthZvf

Targets

    • Target

      Facture.exe

    • Size

      236KB

    • MD5

      eccee50ed45d206ba3c2e75dac5607b8

    • SHA1

      131af9283a990d7dd801609b81c6e1641696bb6a

    • SHA256

      344ae4ecfec1e2a0ca7c2e6b970f077cf55fd1c7cbe41d8963b83848ccf0b229

    • SHA512

      1b1754c5c463991a5e2f33723cd8ae7c51cdd9d1b2040b5481376e302fd9738b2dd32c3272a65e6d20cc2d171e90eb5f7a0346d3fea6b7b33a6159c18673ea99

    • SSDEEP

      3072:QEhKzShSycSMv/jXTahrEOJHMSRRYFFg0pOGTX4oDJEHbRdcumx1u8bTOtHRKqZH:QBn1vcrESHTRYj9FTfUj8D8QqZFrBIp4

    Score
    10/10
    formbookxloaderfqsuloaderratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Blocklisted process makes network request

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks