Resubmissions

19-01-2022 19:22

220119-x28ngscegm 10

19-01-2022 18:50

220119-xgxeqacdg6 10

General

  • Target

    payload.exe

  • Size

    297KB

  • Sample

    220119-xgxeqacdg6

  • MD5

    aefc9702ff5d6d9064ec8e5ea82e4870

  • SHA1

    716ad70dc07a6b7d3c46209de8627bf3f3535361

  • SHA256

    ef986fa9ac50432d1fc1be8e0ace872cbf28cf51d967d6d35647aa3f77acf94e

  • SHA512

    e5180f0d131111627300dd3b61abae59cf77e0d2a4aa50d9b22dec1c270a865caed5fa4130174930ae2810584c4169e9bf56a0b597401014737d60b250580b55

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

uar3

Decoy

sgadvocats.com

mjscannabus.com

hilldaley.com

ksdollhouse.com

hotgiftboutique.com

purebloodsmeet.com

relaunched.info

cap-glove.com

productcollection.store

fulikyy.xyz

remoteaviationjobs.com

bestcleancrystal.com

virtualorganizationpartner.com

bookgocar.com

hattuafhv.quest

makonigroup.com

officecom-myaccount.com

malgorzata-lac.com

e-learningeducators.com

hygilaur.com

Targets

    • Target

      payload.exe

    • Size

      297KB

    • MD5

      aefc9702ff5d6d9064ec8e5ea82e4870

    • SHA1

      716ad70dc07a6b7d3c46209de8627bf3f3535361

    • SHA256

      ef986fa9ac50432d1fc1be8e0ace872cbf28cf51d967d6d35647aa3f77acf94e

    • SHA512

      e5180f0d131111627300dd3b61abae59cf77e0d2a4aa50d9b22dec1c270a865caed5fa4130174930ae2810584c4169e9bf56a0b597401014737d60b250580b55

    • Xloader

      Xloader is a rebranded version of Formbook malware.

    • Xloader Payload

    • Adds policy Run key to start application

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

Modify Registry

2
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

System Information Discovery

1
T1082

Collection

Data from Local System

1
T1005

Tasks