formbook

General

Target

7cc9e9b1b2094c17d806dfba5b9852c1446a1eff34b4c6fb9440c7bf9a224558
Size

508KB
Sample

230210-lpvejsgg67
MD5

abeda51681ababbfbea5aae1693fb79f
SHA1

39042770e0fa6d074c57a3aecca66a0f158f019d
SHA256

7cc9e9b1b2094c17d806dfba5b9852c1446a1eff34b4c6fb9440c7bf9a224558
SHA512

30a2c6b232b2f38cbd830530cebabef4d12610dc69b5f242aeb98ea242023448c78e780894b80d5f6aff6fae2e57a662f2d89b40ee8c9f610c11e9cc6c8d1022
SSDEEP

12288:1Y0ukcHj/50WRfx0Bg4xR0VKuWfeopJzByb5m:1YGcD/2QfuB1xmnWrJmA

Score

10^/10

Malware Config

Extracted

Family

formbook

Campaign

poub

Decoy

WY0eksfISzRg4O6c+opnGL6gaw==

moRjn9ExtYi8UmUo+Tya

2vME+GedoxzFnuLXesUoVj4=

EvW4JWJ1NQ8nN3tA3SM=

2mK9efMZMgN1VOs=

8d0jua5b0J6AQEW7

/2cyThOd37DSTYMASDye4Q0t/Vs=

ral+tbIh2KKAQEW7

YLY9jsPtYB/FRmMo+Tya

R1WcElWAMtFxFrVqtZT2ZpIS9xRZNho=

KFXGg/T1pCC9GjrxUPTcjw==

8mMlK5nDwjjPFTP5jMtAtQ0t/Vs=

c7am8nhhlCo=

UW91trZj6dENxuRdpxOvW1Cf

sjOMUcvq6lYJCZEfV4euFzY=

62nBgPjdmWQkmWElww==

64E8JqA1aruSUvw=

NqI1reXpcR+REye0

8+y1oOsbjgSyEhjXUPTcjw==

Rx9by8gNBwN1VOs=

Targets

- Target
  
  7cc9e9b1b2094c17d806dfba5b9852c1446a1eff34b4c6fb9440c7bf9a224558
- Size
  
  508KB
- MD5
  
  abeda51681ababbfbea5aae1693fb79f
- SHA1
  
  39042770e0fa6d074c57a3aecca66a0f158f019d
- SHA256
  
  7cc9e9b1b2094c17d806dfba5b9852c1446a1eff34b4c6fb9440c7bf9a224558
- SHA512
  
  30a2c6b232b2f38cbd830530cebabef4d12610dc69b5f242aeb98ea242023448c78e780894b80d5f6aff6fae2e57a662f2d89b40ee8c9f610c11e9cc6c8d1022
- SSDEEP
  
  12288:1Y0ukcHj/50WRfx0Bg4xR0VKuWfeopJzByb5m:1YGcD/2QfuB1xmnWrJmA
Score

10^/10

formbook xloader poub loader persistence rat spyware stealer trojan
- Formbook
  Formbook is a data stealing malware which is capable of stealing data.
  trojan spyware stealer formbook
- Xloader
  Xloader is a rebranded version of Formbook malware.
  loader xloader
- Xloader payload
  rat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Xloader

Xloader payload

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Adds Run key to start application

Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Tasks

static1

behavioral1

behavioral2