formbook

General

Target

4d89f5965d9078fdc4cf78df139efadf7d69b71f4afad21d3c3425f956f23e67
Size

1.9MB
Sample

241121-yqtkvswlgx
MD5

962524dd53b431d322b11d3cb68222ff
SHA1

74ab336d019e9829c607edb6f200ed95ef661cb1
SHA256

4d89f5965d9078fdc4cf78df139efadf7d69b71f4afad21d3c3425f956f23e67
SHA512

7d3441a23322be063ae98cdddedd69ed64dc20caadd38a60ff207ce60050517870fa7eb00341e3fd647a97c9ad40bef57a4fab928c7605b0b374cde057cbea70
SSDEEP

24576:AjmKgIlazx7luYcoU6KterNILaLmfxH9mLuTnAw99sYWKgIlazx7luYcoU6Ktert:A3/kzxzrrECcLHT/kzxzrrECcLHM

Score

10^/10

Malware Config

Extracted

Family

formbook

Campaign

roz2

Decoy

jTSEx/DqnWrhnUQ0UQ==

+8219xzGmr2teTrY+fSBK+NOiLc=

/6YHkqNBJiBHvzaT9f2W

56INgrlbOqaBFx2UX/U=

g0J6uduFMzkyC89A1m8MyELra5CYkg==

WAvnVEtqSgNq4NWIGAXQDw==

rlIzjaLSfvwnMJi2

hfKU4ncqea/ITgg=

YNFrxuPv2d1k/QOeQJqGeyg=

t0g0iJ7Nd90i20hzLkEVRcDa

1FRIgZcmCDwh9ACnP5qGeyg=

DgycCCcM7dZP0NaJOpqGeyg=

Hv2jETNeVgEnMJi2

iQT+U40uH2BeEMBvoaNh2I7D

B47/RHqHdm7inUQ0UQ==

HNWL4RdJKOonMJi2

E42gATYJ7NxBxcCv01T/Y925Vnt0

P/rfWIvXyITjrXNcBASU

3pfoX4MmDD0TnTKT9f2W

YevnQ1Wrj/z3k04K1GUjjiA=

Targets

- Target
  
  07NZTB1lYJ3GNVY.exe
- Size
  
  1.1MB
- MD5
  
  3452e570af3991f472169eee6c203c1e
- SHA1
  
  049ac3139640b3df7c840d2c24daff9dd094f779
- SHA256
  
  477ca79c48c0ae888a5da641e5fbabc7d7c8ba7100e77a9b09cc66719360b086
- SHA512
  
  4cf1057e557b640b5cbc9c1face2a90ce95b623f495101eb8db4e7b24503f6b3490916b214ed8baaee888cbe7e3a33c0c03010f4654e6bffc58b8b048aa11455
- SSDEEP
  
  24576:IkxmQl/6CFEjy+viaAlPVW4XwHwcGXJoRx:IkxvlZFEjRKaItXAG5oRx
Score

10^/10

formbook xloader roz2 discovery loader rat spyware stealer trojan
- Formbook
  Formbook is a data stealing malware which is capable of stealing data.
  trojan spyware stealer formbook
- Formbook family
  formbook
- Xloader
  Xloader is a rebranded version of Formbook malware.
  loader xloader
- Xloader family
  xloader
- Xloader payload
  rat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Suspicious use of SetThreadContext
behavioral1 behavioral2
- Target
  
  07NZTB1lYJ3GNVY.exe
- Size
  
  1.1MB
- MD5
  
  3452e570af3991f472169eee6c203c1e
- SHA1
  
  049ac3139640b3df7c840d2c24daff9dd094f779
- SHA256
  
  477ca79c48c0ae888a5da641e5fbabc7d7c8ba7100e77a9b09cc66719360b086
- SHA512
  
  4cf1057e557b640b5cbc9c1face2a90ce95b623f495101eb8db4e7b24503f6b3490916b214ed8baaee888cbe7e3a33c0c03010f4654e6bffc58b8b048aa11455
- SSDEEP
  
  24576:IkxmQl/6CFEjy+viaAlPVW4XwHwcGXJoRx:IkxvlZFEjRKaItXAG5oRx
Score

10^/10

formbook xloader roz2 discovery loader rat spyware stealer trojan
- Formbook
  Formbook is a data stealing malware which is capable of stealing data.
  trojan spyware stealer formbook
- Formbook family
  formbook
- Xloader
  Xloader is a rebranded version of Formbook malware.
  loader xloader
- Xloader family
  xloader
- Xloader payload
  rat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Suspicious use of SetThreadContext
behavioral3 behavioral4

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Formbook family

Xloader

Xloader family

Xloader payload

Checks computer location settings

Deletes itself

Suspicious use of SetThreadContext

Formbook

Formbook family

Xloader

Xloader family

Xloader payload

Checks computer location settings

Deletes itself

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4