formbook

General

Target

537ca83e58dfc0da3a87d09b50fcbf04ec5ba736c19c9f7cec9733a58c57a961
Size

274KB
Sample

230306-djh6bshh6w
MD5

a67b9455e07da0e206e388aadfce24ee
SHA1

ae4726f82b0a392b91655f91fdd634f810722027
SHA256

537ca83e58dfc0da3a87d09b50fcbf04ec5ba736c19c9f7cec9733a58c57a961
SHA512

a086bcc0ff5789d780aee0aa64fb09053fb1736a0dc70bd3b6321e0c3671b48d1e0d220d6a4e85c8c2ca0ef0122a4a7c3f3ca9d42bbda62b093c54aa73f603f2
SSDEEP

6144:PYa6kSIwjB9pgGrwb35p84UEexcGqBpFtofapRQlJc6QNM:PYiShSGrspYEycnPksQnCK

Score

10^/10

Malware Config

Extracted

Family

formbook

Campaign

poub

Decoy

WY0eksfISzRg4O6c+opnGL6gaw==

moRjn9ExtYi8UmUo+Tya

2vME+GedoxzFnuLXesUoVj4=

EvW4JWJ1NQ8nN3tA3SM=

2mK9efMZMgN1VOs=

8d0jua5b0J6AQEW7

/2cyThOd37DSTYMASDye4Q0t/Vs=

ral+tbIh2KKAQEW7

YLY9jsPtYB/FRmMo+Tya

R1WcElWAMtFxFrVqtZT2ZpIS9xRZNho=

KFXGg/T1pCC9GjrxUPTcjw==

8mMlK5nDwjjPFTP5jMtAtQ0t/Vs=

c7am8nhhlCo=

UW91trZj6dENxuRdpxOvW1Cf

sjOMUcvq6lYJCZEfV4euFzY=

62nBgPjdmWQkmWElww==

64E8JqA1aruSUvw=

NqI1reXpcR+REye0

8+y1oOsbjgSyEhjXUPTcjw==

Rx9by8gNBwN1VOs=

Targets

- Target
  
  537ca83e58dfc0da3a87d09b50fcbf04ec5ba736c19c9f7cec9733a58c57a961
- Size
  
  274KB
- MD5
  
  a67b9455e07da0e206e388aadfce24ee
- SHA1
  
  ae4726f82b0a392b91655f91fdd634f810722027
- SHA256
  
  537ca83e58dfc0da3a87d09b50fcbf04ec5ba736c19c9f7cec9733a58c57a961
- SHA512
  
  a086bcc0ff5789d780aee0aa64fb09053fb1736a0dc70bd3b6321e0c3671b48d1e0d220d6a4e85c8c2ca0ef0122a4a7c3f3ca9d42bbda62b093c54aa73f603f2
- SSDEEP
  
  6144:PYa6kSIwjB9pgGrwb35p84UEexcGqBpFtofapRQlJc6QNM:PYiShSGrspYEycnPksQnCK
Score

10^/10

formbook xloader poub loader rat spyware stealer trojan
- Formbook
  Formbook is a data stealing malware which is capable of stealing data.
  trojan spyware stealer formbook
- Xloader
  Xloader is a rebranded version of Formbook malware.
  loader xloader
- Xloader payload
  rat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Xloader

Xloader payload

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Tasks

static1

behavioral1

behavioral2