formbook

General

Target

DHL INVOICE#-002834.exe
Size

306KB
Sample

221202-vxlxtagf89
MD5

9564349d362fe854594e13217800ea9f
SHA1

5067b33410d6a859f96e07d7fa006446b5e3abdb
SHA256

4aba8fe16a25f04df115b34a57b6fff9782664c208348cf57d921d12f158c8b1
SHA512

d919fbc75fd973ddd8e425b728d3ab7c251b5671493517d4eb8e825f6b26a4b5f36d70468b171a336bafcc6c8eaf9deea3c31af7ba26b9ba1aee9649b0b5a1ca
SSDEEP

6144:NBn0JAr0W067hhLsgQfQIRHWGdEzFgu+sdIEOZz9Kgzl:EerA67sF9Hj2RzEkql

Score

10^/10

Malware Config

Extracted

Family

formbook

Campaign

codp

Decoy

WLwbp9IgDF0DRbuq

oNQ7DHBzVHVMTxxxFCORk65Z5w==

eKyDm2P0S8i8tXrGSRxyN/GB+g==

DWLDupksnDvfKi7Q7PI=

JAaYbOFx1G0f4pcM36gDB3YaG796

KWQ71Z4U7+2Nv8K72OXED5M9oe8=

YJpvEHW5TU/wL02R9TiN0A==

tpQX78fPprFMi7ocSgXfUNYKpTq33Icp

a9Z0eju3FKFA/YBy+MQfG3QaG796

uQzt58fSssDUenxacQCY2g==

vijGzYPYOfi2gxZLhlbA

kZfzlQg7IGPxc29BJA==

dcQu+blQlxGyZu7qw5P4L6s=

TTIXAcXMr85yqqvxWBMqdrw=

xZb/tyGC8sOjIS7Q7PI=

KnzenvO+cXkVS3biKfRDwJ9Q5Q==

ZqZvDt9+yYxqh1Si

vZD8CtVZigY/cqnmLA==

QJy2dd/p0MO1Ji7Q7PI=

l+Hmoea3jsiAcqnmLA==

Extracted

Family

xloader

Version

3.ƅ

Campaign

codp

Decoy

WLwbp9IgDF0DRbuq

oNQ7DHBzVHVMTxxxFCORk65Z5w==

eKyDm2P0S8i8tXrGSRxyN/GB+g==

DWLDupksnDvfKi7Q7PI=

JAaYbOFx1G0f4pcM36gDB3YaG796

KWQ71Z4U7+2Nv8K72OXED5M9oe8=

YJpvEHW5TU/wL02R9TiN0A==

tpQX78fPprFMi7ocSgXfUNYKpTq33Icp

a9Z0eju3FKFA/YBy+MQfG3QaG796

uQzt58fSssDUenxacQCY2g==

vijGzYPYOfi2gxZLhlbA

kZfzlQg7IGPxc29BJA==

dcQu+blQlxGyZu7qw5P4L6s=

TTIXAcXMr85yqqvxWBMqdrw=

xZb/tyGC8sOjIS7Q7PI=

KnzenvO+cXkVS3biKfRDwJ9Q5Q==

ZqZvDt9+yYxqh1Si

vZD8CtVZigY/cqnmLA==

QJy2dd/p0MO1Ji7Q7PI=

l+Hmoea3jsiAcqnmLA==

Targets

- Target
  
  DHL INVOICE#-002834.exe
- Size
  
  306KB
- MD5
  
  9564349d362fe854594e13217800ea9f
- SHA1
  
  5067b33410d6a859f96e07d7fa006446b5e3abdb
- SHA256
  
  4aba8fe16a25f04df115b34a57b6fff9782664c208348cf57d921d12f158c8b1
- SHA512
  
  d919fbc75fd973ddd8e425b728d3ab7c251b5671493517d4eb8e825f6b26a4b5f36d70468b171a336bafcc6c8eaf9deea3c31af7ba26b9ba1aee9649b0b5a1ca
- SSDEEP
  
  6144:NBn0JAr0W067hhLsgQfQIRHWGdEzFgu+sdIEOZz9Kgzl:EerA67sF9Hj2RzEkql
Score

10^/10

formbook xloader codp loader rat spyware stealer trojan
- Formbook
  Formbook is a data stealing malware which is capable of stealing data.
  trojan spyware stealer formbook
- Xloader
  Xloader is a rebranded version of Formbook malware.
  loader xloader
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Targets

Xloader

Executes dropped EXE

Checks computer location settings

Loads dropped DLL

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2