General

  • Target

    b6998cb14c536827f5ee6c4ad2b3c74ed0fb2a3e28a5f4f1b132d8918e47f0a7

  • Size

    266KB

  • Sample

    220521-bpwmhafccr

  • MD5

    4deadfceef6d525b206699982540a3ba

  • SHA1

    729278ea30b756c9aed6bbfeb60a0d7a98600fe8

  • SHA256

    b6998cb14c536827f5ee6c4ad2b3c74ed0fb2a3e28a5f4f1b132d8918e47f0a7

  • SHA512

    669f9758ea76c6d09737961654c9661213425cddd4acd7b643b791f1337a20e15694bd0698ab7d97c364c0f5cfe50dd9b1be4d452b2b6d3c809f8252e0f7d539

Malware Config

Extracted

Family

xloader

Version

2.0

Campaign

b6fg

Decoy

multlockmt5.com

mohajrannoor.com

robynhoodofretail.info

belinv.com

hotellasab.com

kibrismosad.com

xn--fxwm39aeb590h.xn--io0a7i

resetbrasil.com

tcsonhvac.com

theresav.net

bohoqi.info

machinafuturae.com

mambavault.com

xn--980am9a.top

yumiang.com

evntmonitor.com

83003kk.com

triterm.com

8800pe.com

silvanstudio.com

Targets

    • Target

      PO8973274.exe

    • Size

      406KB

    • MD5

      969965b7bdf5b6736963b4222747611a

    • SHA1

      462939760dabc080adde3a2c650187c2278a15c4

    • SHA256

      7c110f7a45aba8f26ba0eb32c024ea55598ec54d9ceda6cf13272a31d2cc6da0

    • SHA512

      9e8b56d915986245517f6f481de1d04102197d4dfe17c5611289a148889282a4a2ff0f0ab8502fdb89d2dc51b4ab2d6e9bf20cdf289ebeef3de98da7d4836141

    • Xloader

      Xloader is a rebranded version of Formbook malware.

    • suricata: ET MALWARE FormBook CnC Checkin (GET)

      suricata: ET MALWARE FormBook CnC Checkin (GET)

    • suricata: ET MALWARE FormBook CnC Checkin (POST) M2

      suricata: ET MALWARE FormBook CnC Checkin (POST) M2

    • Xloader Payload

    • Adds policy Run key to start application

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Uses the VBS compiler for execution

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scripting

1
T1064

Persistence

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

Modify Registry

3
T1112

Scripting

1
T1064

Credential Access

Credentials in Files

1
T1081

Collection

Data from Local System

1
T1005

Tasks