Overview

overview

10

Static

static

1

RFQ PT089110.exe

windows7-x64

10

RFQ PT089110.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    76565BFAF2FE4E6CA50046FCD0CD13DD3EA45398A01A343BF9CEC3CFE0998388

  • Size

    260KB

  • Sample

    221213-2p5hhsbc9w

  • MD5

    d17fb4dd8e5255419111d5e2052919cc

  • SHA1

    4c9c4ebfe94b418d2247d1a5f0935704d213eaa3

  • SHA256

    76565bfaf2fe4e6ca50046fcd0cd13dd3ea45398a01a343bf9cec3cfe0998388

  • SHA512

    fa28121f7a16d56bd1796e32ee2d701566c7dbf5d06bdb31fd3f3f68d6a283f6e654fb521ccdac1df6382ea4b0a2587ffed3a6726ad450ed6ba3441cd7b56c31

  • SSDEEP

    6144:/urZNXTZH8wB3HsS2FG7WZdMDS3jBFJJEtQH8:/ulbHjB3f7WLQCHJ6tQc

Score
10/10
formbookxloaderm5oeloaderratspywarestealertrojan

Malware Config

Extracted

Family

formbook

Campaign

m5oe

Decoy

HdR8hG6r12hBYuHY4zv6YeeFPQ==

tD1V9gswYvgQXEGd

1xKtJ1LdqRYMRMC84U1A

MbhjiWb7Lz8z7KIWl3UyUIJwA6Tb

joVB5Xggy2RtE+odsZg=

TrduAIay6Y3SvoIK20xI

pSna7LOsXXwXT/zz3Iow4g==

QnthmO4Qst5gC3sDoA==

eAirzOOgO7SOCenz3Iow4g==

xg0uSbfLTg==

YWQXwyGRzPEHzGrDFE8CBSE=

ujLnfuXoH9dbgHIK20xI

291v0XsGFrYQXEGd

MRvTd/qMuaHpjCM=

X131fLC6VWX4MsvCb2IPjIfq8wlksWfg

Y9Bur8DbgqFt/Yni86MMCCE=

q6RTBmJkmy5pWTmmCCrvmuCDPw==

mQS26DojT+EQXEGd

sjHQ+Kav2Wx9FeodsZg=

JA24UKnTA5re1LhcQaVo/w==

Extracted

Family

xloader

Version

3.ƅ

Campaign

m5oe

Decoy

HdR8hG6r12hBYuHY4zv6YeeFPQ==

tD1V9gswYvgQXEGd

1xKtJ1LdqRYMRMC84U1A

MbhjiWb7Lz8z7KIWl3UyUIJwA6Tb

joVB5Xggy2RtE+odsZg=

TrduAIay6Y3SvoIK20xI

pSna7LOsXXwXT/zz3Iow4g==

QnthmO4Qst5gC3sDoA==

eAirzOOgO7SOCenz3Iow4g==

xg0uSbfLTg==

YWQXwyGRzPEHzGrDFE8CBSE=

ujLnfuXoH9dbgHIK20xI

291v0XsGFrYQXEGd

MRvTd/qMuaHpjCM=

X131fLC6VWX4MsvCb2IPjIfq8wlksWfg

Y9Bur8DbgqFt/Yni86MMCCE=

q6RTBmJkmy5pWTmmCCrvmuCDPw==

mQS26DojT+EQXEGd

sjHQ+Kav2Wx9FeodsZg=

JA24UKnTA5re1LhcQaVo/w==

Targets

    • Target

      RFQ PT089110.exe

    • Size

      272KB

    • MD5

      8ea739a14035ea523b015f33eafe6953

    • SHA1

      228ee69b1fccea68b79f9c1a9bb9796882696cf3

    • SHA256

      1a685538deaab9e0cfe393b43f4f08e48c076ce115911c46e93952a121322c87

    • SHA512

      76d462569c16143c41ce75eb8e5f4f6304f32f42f939433752a5aa3fefcfa4550da8a55179dfef2d3eef0c6a41a9de8018de785669bfc6daf337a14323f98f2a

    • SSDEEP

      6144:9kwrUMSvXxBADF+bVEN8fyqNkpHVtxgWljiXcU0GfJyqI2q:/UMEBBAAJVfjS1EWljiXcU0EJyqy

    Score
    10/10
    formbookxloaderm5oeloaderratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks