Threat video1:00
Formbook (XLoader) Manufacturing Lures: Detection & IOCs
ZIP-attached droppers lead to a GHOST.dll injector that hollows aspnet_compiler.exe for Formbook. Get 24 IOCs, 9 detection rules and a free Splunk SPL rule.
Read the full threat intel for Formbook (XLoader) Manufacturing Lures: Detection & IOCs →
Chapters
- 0:00The hookFormbook hid in Windows tools.
- 0:04The storyAn emailed ZIP lure.
- 0:10Attack pathVictim opens script; obfuscated JavaScript drops PowerShell.
- 0:23AttributionNo threat actor is attributed.
- 0:27Indicators of compromise17 indicators to hunt: 3 IPs, 2 domains and 2 URLs, and more.
- 0:34MITRE ATT&CK techniques16 ATT&CK techniques, from initial access to command and control.
- 0:39Remediation5 steps now: Block www[.]hlushkova[.]top and www[.]stanbicfinanceug[.]com at DNS and web proxy.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00Formbook hid in Windows tools.
0:05An emailed ZIP lure.
0:06It targets European manufacturing.
0:10Victim opens script; obfuscated JavaScript drops PowerShell.
0:15Hidden PowerShell runs next.
0:17Formbook runs inside a legit Windows tool.
0:20Browser credentials are stolen.
0:24No threat actor is attributed. Confidence: low.
0:2817 indicators to hunt: 3 IPs, 2 domains and 2 URLs, and more.
0:3416 ATT&CK techniques, from initial access to command and control.
0:395 steps now: Block www[.]hlushkova[.]top and www[.]stanbicfinanceug[.]com at DNS and web proxy.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.