Overview

overview

10

Static

static

1

ORDER N. 1487.exe

windows7_x64

10

ORDER N. 1487.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ORDER N. 1487.exe

  • Size

    334KB

  • Sample

    211022-n7fp8abeh2

  • MD5

    08ae4dd275718d077172abb99be15464

  • SHA1

    cf99068f0ea4acafc515fbe334a71e62401ac757

  • SHA256

    7716fec715a46b0eb4518d53703b0fc2186e6a473a876de7aee9155ec289f93a

  • SHA512

    6fca40792388c3047701dd1a24854b420aaba8fb194dee35b58cecdaf57a65f6f843b77fe4ce1d89aee8cfd553d516afd76cefbc1b96349d3890015f191d1d42

Score
10/10
formbookxloaderu3jaloaderpersistenceratspywarestealertrojan

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

u3ja

C2

http://www.global-shopings.com/u3ja/

Decoy

emiratescomm.net

whattodotenerife.com

bspq-jlcd.com

torobesttanker.info

projectcentered.com

agglog.com

francesbypoppy.com

lakenormanpilates.net

chaseatms.com

bendarlingart.com

blogjust.xyz

wodeluzhou.com

p6ynwcxrxetb.biz

servpix.com

eddysearthmoving.com

rvafootcarenurses.com

contessa.store

jasonconcerttickets.com

umldbe.xyz

noroesteremotos.online

Targets

    • Target

      ORDER N. 1487.exe

    • Size

      334KB

    • MD5

      08ae4dd275718d077172abb99be15464

    • SHA1

      cf99068f0ea4acafc515fbe334a71e62401ac757

    • SHA256

      7716fec715a46b0eb4518d53703b0fc2186e6a473a876de7aee9155ec289f93a

    • SHA512

      6fca40792388c3047701dd1a24854b420aaba8fb194dee35b58cecdaf57a65f6f843b77fe4ce1d89aee8cfd553d516afd76cefbc1b96349d3890015f191d1d42

    Score
    10/10
    xloaderu3jaloaderratformbookpersistencespywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Adds policy Run key to start application

      persistence

    • Executes dropped EXE

    • Deletes itself

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Command-Line Interface

1
T1059

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

System Information Discovery

2
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks