Overview

overview

10

Static

static

SNO22 5954...14.exe

windows7_x64

10

SNO22 5954...14.exe

windows10_x64

10

Resubmissions

25-01-2022 14:51

220125-r8j1taheg5 10

25-01-2022 14:19

220125-rmt9naghgj 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    SNO22 595406_RACX-159814.exe

  • Size

    740KB

  • Sample

    220125-r8j1taheg5

  • MD5

    57d59a3b3d87c9e5808da7ad2b013955

  • SHA1

    22a3f4dceee7b5f63e9e940a435412362f947878

  • SHA256

    58fb47124bf49f4190852baec863af03f73216cbba65c7eaa527f6ec6612e42b

  • SHA512

    63b009c902adb07e83d9e28917e1f3ee5a4a49ae426ca4b99a29eeaa961c56e1456fceb02f078578f37a271e98276249ba182686bfdca60053cc8bef08802125

Score
10/10
formbookxloaderp8celoaderpersistenceratspywarestealertrojan

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

p8ce

Decoy

wishmeluck1.xyz

nawabumi.com

terra.fish

eoraipsumami.quest

awakeningyourid.com

csyein.com

tslsinteligentes.com

cataractusa.com

capitalwheelstogo.com

staffremotely.com

trashbinwasher.com

blaneyparkrendezvous.com

yolrt.com

northendtaproom.com

showgeini.com

b95206.com

almcpersonaltraining.com

lovabledoodleshome.com

woodlandstationcondos.com

nikahlive.com

Targets

    • Target

      SNO22 595406_RACX-159814.exe

    • Size

      740KB

    • MD5

      57d59a3b3d87c9e5808da7ad2b013955

    • SHA1

      22a3f4dceee7b5f63e9e940a435412362f947878

    • SHA256

      58fb47124bf49f4190852baec863af03f73216cbba65c7eaa527f6ec6612e42b

    • SHA512

      63b009c902adb07e83d9e28917e1f3ee5a4a49ae426ca4b99a29eeaa961c56e1456fceb02f078578f37a271e98276249ba182686bfdca60053cc8bef08802125

    Score
    10/10
    xloaderp8celoaderpersistenceratformbookspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Adds policy Run key to start application

      persistence

    • Executes dropped EXE

    • Deletes itself

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Command-Line Interface

1
T1059

Persistence

Registry Run Keys / Startup Folder

2
T1060

Privilege Escalation

Defense Evasion

Modify Registry

3
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks