General

  • Target

    PAYMENT ADVICE.zip

  • Size

    409KB

  • Sample

    210922-t8lkrafgfq

  • MD5

    d07032ca5a8f953dbc4155c7b4ccdbbe

  • SHA1

    ca3394efb15d6a83fb806fe25c1b2c24a740e4fe

  • SHA256

    7f18e9b540c48ead7213e3d7fb24232e82aa73c1e435410d8b9946064604b6e7

  • SHA512

    b513292d2b2db12e4e240ff46dd73d3b6ddfde9bf274e3229ecd839e6bcc67895697eb398463057e58dd57804cbfb6a3a6a6feaa3db26628eed0fa73ede3c0d8

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

c2ue

C2

http://www.heidevelop.xyz/c2ue/

Decoy

isportdata.com

stellarex.energy

hsucollections.com

menuhaisan.com

joe-tzu.com

lumichargemktg.com

uae.tires

rapidcae.com

softwaresystemsolutions.com

s-galaxy.website

daewon-talks.net

northgamesnetwork.com

catalogue-bouyguestele.com

criativanet.com

theseasonalshift.com

actionfoto.online

openmaildoe.com

trashpenguin.com

ennopure.net

azurermine.com

Targets

    • Target

      PAYMENT ADVICE.exe

    • Size

      822KB

    • MD5

      24960042ad6c12059fc424d9119ebbba

    • SHA1

      a5b44dc60c82a59c6eeeab63b8d38ec9ed2a171e

    • SHA256

      8d536146e57d878eea148bc98170d2f7cad77ea57f0fbefedf3f3c0dcce40ac5

    • SHA512

      0623ed157cad710f3eda179ece6ca41e529b1045d98e773f7252ff1dc8c7f7554a69dc6096353f2b2b5d5872ba2e59c546803169ffcaadbb483220c35fd76d03

    • Xloader

      Xloader is a rebranded version of Formbook malware.

    • suricata: ET MALWARE FormBook CnC Checkin (GET)

      suricata: ET MALWARE FormBook CnC Checkin (GET)

    • Xloader Payload

    • Adds policy Run key to start application

    • Executes dropped EXE

    • Deletes itself

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

Modify Registry

3
T1112

Credential Access

Credentials in Files

1
T1081

Collection

Data from Local System

1
T1005

Tasks