Overview

overview

10

Static

static

10

ff3949d2a8...98.exe

windows7-x64

1

ff3949d2a8...98.exe

windows10-2004-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target
    ff3949d2a8e0d6b08d2b8b643cdfc6a26f44352da217b4a537e9c16d96ed7198.exe
  • Size 172KB
  • Sample230306-kep7eaag3s
  • SHA256 ff3949d2a8e0d6b08d2b8b643cdfc6a26f44352da217b4a537e9c16d96ed7198
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
ratpoubxloaderformbook

Malware Config

Extracted

Family

  • formbook

Campaign

  • poub

Decoy

  • WY0eksfISzRg4O6c+opnGL6gaw==

  • moRjn9ExtYi8UmUo+Tya

  • 2vME+GedoxzFnuLXesUoVj4=

  • EvW4JWJ1NQ8nN3tA3SM=

  • 2mK9efMZMgN1VOs=

  • 8d0jua5b0J6AQEW7

  • /2cyThOd37DSTYMASDye4Q0t/Vs=

  • ral+tbIh2KKAQEW7

  • YLY9jsPtYB/FRmMo+Tya

  • R1WcElWAMtFxFrVqtZT2ZpIS9xRZNho=

  • KFXGg/T1pCC9GjrxUPTcjw==

  • 8mMlK5nDwjjPFTP5jMtAtQ0t/Vs=

  • c7am8nhhlCo=

  • UW91trZj6dENxuRdpxOvW1Cf

  • sjOMUcvq6lYJCZEfV4euFzY=

  • 62nBgPjdmWQkmWElww==

  • 64E8JqA1aruSUvw=

  • NqI1reXpcR+REye0

  • 8+y1oOsbjgSyEhjXUPTcjw==

  • Rx9by8gNBwN1VOs=

Signatures

  • Formbook family
    formbook
  • Xloader family
    xloader
  • Xloader payload 1 IoCs
    rat

File Explorer

  • ff3949d2a8e0d6b08d2b8b643cdfc6a26f44352da217b4a537e9c16d96ed7198.exe
    .exe 172KB

ff3949d2a8e0d6b08d2b8b643cdfc6a26f44352da217b4a537e9c16d96ed7198.exe

  • SHA256 ff3949d2a8e0d6b08d2b8b643cdfc6a26f44352da217b4a537e9c16d96ed7198
  • MD5 SHA1 SHA512 SSDEEP
windowsx86

  • Xloader payload

    rat
Minor OS version
Major OS version
Entry point
130832
Magic Number
267
Subsystem
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE
PDB paths