Overview

overview

10

Static

static

1

Port_UETQY...df.exe

windows7_x64

10

Port_UETQY...df.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Port_UETQYDYA_99381,pdf.exe

  • Size

    246KB

  • Sample

    211028-psv22agcgn

  • MD5

    6013bdae92b82faae5b32efadb39530f

  • SHA1

    6eec1e1ab9c075b3126987d49bf4540b37accb9f

  • SHA256

    1ea4325defe122660025640e56aa51f5f2b131ac032a50de3e2d9a0a66254920

  • SHA512

    cbe047531effb3718c66aa298a39a5a67c18c8da2b661704938c3993bac7e50e0df4f082949e4ad79687e4d296c9b4d376ee189821ebd182047caec8342fc8ec

Score
10/10
xloaderdgt9loaderpersistenceratspywarestealersuricata

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

dgt9

C2

http://www.discountaquarium.com/dgt9/

Decoy

glimpse-media.com

crimsongomidv.xyz

seo-clicks6.com

cloudbreakhq.com

oakabbey.net

findcasinoslots.com

thehelloloveshop.com

havetsuczyli.quest

celestialtransportation.net

nianlun.wiki

valentinaturals.com

808gang.net

tykaa.com

sparoom.store

empregosbr1.online

visaractivateddprocessing.com

industriamadereraargentina.com

ekopressbrake.com

984561.com

oklahomacasinoreviews.com

Targets

    • Target

      Port_UETQYDYA_99381,pdf.exe

    • Size

      246KB

    • MD5

      6013bdae92b82faae5b32efadb39530f

    • SHA1

      6eec1e1ab9c075b3126987d49bf4540b37accb9f

    • SHA256

      1ea4325defe122660025640e56aa51f5f2b131ac032a50de3e2d9a0a66254920

    • SHA512

      cbe047531effb3718c66aa298a39a5a67c18c8da2b661704938c3993bac7e50e0df4f082949e4ad79687e4d296c9b4d376ee189821ebd182047caec8342fc8ec

    Score
    10/10
    xloaderdgt9loaderratsuricatapersistencespywarestealer

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • suricata: ET MALWARE FormBook CnC Checkin (GET)

      suricata: ET MALWARE FormBook CnC Checkin (GET)

      suricata

    • suricata: ET MALWARE FormBook CnC Checkin (POST) M2

      suricata: ET MALWARE FormBook CnC Checkin (POST) M2

      suricata

    • Xloader Payload

      rat

    • Executes dropped EXE

    • Deletes itself

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks