General

  • Target

    Siparis onayi. 03425527829.exe

  • Size

    848KB

  • Sample

    220616-hvxv3sgaeq

  • MD5

    18dff97ccac6acf6f502e5510bf8dbf1

  • SHA1

    6e21c5e7adbed192838cfaebb7e5e884722b17d2

  • SHA256

    8b6bed9a53981b3909a06544e89849fd738f9aabf912c36e21777677204e251d

  • SHA512

    39f4df8761259ca052e853f2565dc0a05287990d1b4c8fdaca76251aab6f15af3edf4dc901bd95f235590df310e1960e617c9ae8ec2bb1ab035476426a816acf

Malware Config

Extracted

Family

xloader

Version

2.6

Campaign

uj3c

Decoy

copimetro.com

choonchain.com

luxxwireless.com

fashionweekofcincinnati.com

campingshare.net

suncochina.com

kidsfundoor.com

testingnyc.co

lovesoe.com

vehiclesbeenrecord.com

socialpearmarketing.com

maxproductdji.com

getallarticle.online

forummind.com

arenamarenostrum.com

trisuaka.xyz

designgamagazine.com

chateaulehotel.com

huangse5.com

esginvestment.tech

Targets

    • Target

      Siparis onayi. 03425527829.exe

    • Size

      848KB

    • MD5

      18dff97ccac6acf6f502e5510bf8dbf1

    • SHA1

      6e21c5e7adbed192838cfaebb7e5e884722b17d2

    • SHA256

      8b6bed9a53981b3909a06544e89849fd738f9aabf912c36e21777677204e251d

    • SHA512

      39f4df8761259ca052e853f2565dc0a05287990d1b4c8fdaca76251aab6f15af3edf4dc901bd95f235590df310e1960e617c9ae8ec2bb1ab035476426a816acf

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    • Xloader

      Xloader is a rebranded version of Formbook malware.

    • suricata: ET MALWARE FormBook CnC Checkin (GET)

      suricata: ET MALWARE FormBook CnC Checkin (GET)

    • ModiLoader Second Stage

    • Xloader Payload

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks