Overview

overview

10

Static

static

1

ORDER_80.exe

windows7_x64

10

ORDER_80.exe

windows10-2004_x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    af2ab44a73066cdf3468fcf9a6f92f93218bfa6c777aa1dc30b219d6696b9cfa

  • Size

    1.2MB

  • Sample

    220201-wek38saeb4

  • MD5

    35a992cb33867a790b26884019f785f0

  • SHA1

    cfb8e4f3f27f3c94370757bf715e70d62b2e09e2

  • SHA256

    af2ab44a73066cdf3468fcf9a6f92f93218bfa6c777aa1dc30b219d6696b9cfa

  • SHA512

    4d29246b01239bcf6eedb0689b1946dde9aba760da6f1fbcc0387adc36de524ef8f23853a73d06f2288a10620a003222243a6a4d2dd9852fa1fd31e7b0d6f6b6

Score
10/10
formbookxloaderuar3loaderpersistenceratspywarestealertrojan

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

uar3

Decoy

sgadvocats.com

mjscannabus.com

hilldaley.com

ksdollhouse.com

hotgiftboutique.com

purebloodsmeet.com

relaunched.info

cap-glove.com

productcollection.store

fulikyy.xyz

remoteaviationjobs.com

bestcleancrystal.com

virtualorganizationpartner.com

bookgocar.com

hattuafhv.quest

makonigroup.com

officecom-myaccount.com

malgorzata-lac.com

e-learningeducators.com

hygilaur.com

Targets

    • Target

      ORDER_80.PIF

    • Size

      246KB

    • MD5

      e15ae6b598e9b227a07a09056570afd6

    • SHA1

      46b5a6c316570f75be5f9732ece769547d431e39

    • SHA256

      2c9c53afeadf78570137cbee063eb4446a2f2086d516b348199ed4500434c126

    • SHA512

      9648aaae24b7384a12b3c165591c781c375cec2af31afa60002060d9ba81e0f4d616d50ac1e10dedd6d7c363a56ccdceb29598aac517d7dd4341b24256b93ad1

    Score
    10/10
    formbookxloaderuar3loaderpersistenceratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Executes dropped EXE

    • Deletes itself

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks