Overview

overview

10

Static

static

1

Enquiry docs.exe

windows7_x64

10

Enquiry docs.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Enquiry docs.zip

  • Size

    246KB

  • Sample

    211026-b1w3eahfck

  • MD5

    50fd6589fce8b273570e1130dded5761

  • SHA1

    f4f5209ad44ae7ca5a216ee08e2d82eb5d5e9f82

  • SHA256

    c6fd5cd65ad33c112f367478404014e7e20c487e1ee57a460ad568a352b91f40

  • SHA512

    cd1598eb7427c2c9a76a386ce5f77b683bc204191cd07b84683e0fd723e92f314e86ec50f13cfabd27d3507871149e0a3540d1319248282156ecef328a980d7c

Score
10/10
xloaderga6bloaderpersistenceratspywarestealersuricata

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

ga6b

C2

http://www.egyptian-museum.com/ga6b/

Decoy

diasporacospices.com

sd-shenghe.com

onlinewritingjobs.net

greenstreamgroup.store

garageair.agency

idh-bf.com

middenhavendambreskens.com

szkoleniawcag.online

wiremefeelings.com

ottosperformance.com

brothermush.com

weiserpath.com

baohiemtv24h.com

glassgalaxynft.com

spiritualmind.space

18130072012.com

3v0.space

smartgadgetscompare.com

corvusexpeditii.xyz

egcontabilidade.website

Targets

    • Target

      Enquiry docs.exe

    • Size

      259KB

    • MD5

      57e634d27ebeb3eb96a21efb56654952

    • SHA1

      3a73a99013039be2615cbefd0cba1e4f5d10ea45

    • SHA256

      d0df1d753742cd9d3144c77f0b343aac22fdab2a2d32bd41872dd838e2eb8a34

    • SHA512

      20626c979cee7d4780d95c020e7ee92719595d56f6e5bcdd40a7f746c89f8961c1441c2e8867110478a093bfde4c2085f27b42baf0296274d8f049c2e28de844

    Score
    10/10
    xloaderga6bloaderratsuricatapersistencespywarestealer

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • suricata: ET MALWARE FormBook CnC Checkin (GET)

      suricata: ET MALWARE FormBook CnC Checkin (GET)

      suricata

    • Xloader Payload

      rat

    • Adds policy Run key to start application

      persistence

    • Executes dropped EXE

    • Deletes itself

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Command-Line Interface

1
T1059

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

System Information Discovery

2
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks