Overview

overview

10

Static

static

osc.js

windows7_x64

10

osc.js

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    osc.js

  • Size

    380KB

  • Sample

    220620-r1wdwagbe5

  • MD5

    ec13e690ff5ea4cae17f1862b9fa8f3e

  • SHA1

    45963548c7604ac4ead234c6605d0a67e9d29cdf

  • SHA256

    354e6dcfaea16e4f37c6608a890b23a6a801b976f3dc4d11db6274014045d9a4

  • SHA512

    9bb1635b17a41293f7f094947466d45553a16d0209bb6155d5d9d3da3ab8ac8a3e0e2d91a54d85c24b893cb78313bb0d2840d210424a82f94add1f9d515925bb

Score
10/10
formbookvjw0rmxloaderr4wfloaderpersistenceratspywarestealersuricatatrojanworm

Malware Config

Extracted

Family

xloader

Version

2.8

Campaign

r4wf

Decoy

eQLhwti8E4CX1m8bp0WK2Q==

axoAyf6nwR9Y43o1nFx+930=

vf9fMlHrgdcI

TRQU8PPgFWegAcLFsjQ5TUX2

CFXUiz7SjsLqcQ==

XKeIL6Nmg+8pokY+wjaooasXRQIt

NLSkgIdanO/4SNPAdlKUrIms7Q==

TTKhgqyuCnCmH7yGa12g8HXrnY/nKGI=

5X0d70pNfaYGRgI=

fXXOk9C1+U9bhkIBIqn8

dN7HmMiv/TtAgyP2tYrEG2Yq4Yw=

HRqUgbJeorn4Zg==

MZ7Sh6xm71vhCNLW

7iFsO188fKYGRgI=

o9VC9kgPVXmCz2gBIqn8

B0y+iMbD+lzhCNLW

ciUeBS0WbdHuVGH+xJU=

Q3334PeyxydNmzoBIqn8

kgHx3RbrgdcI

WQjgo8h9g6YGRgI=

Targets

    • Target

      osc.js

    • Size

      380KB

    • MD5

      ec13e690ff5ea4cae17f1862b9fa8f3e

    • SHA1

      45963548c7604ac4ead234c6605d0a67e9d29cdf

    • SHA256

      354e6dcfaea16e4f37c6608a890b23a6a801b976f3dc4d11db6274014045d9a4

    • SHA512

      9bb1635b17a41293f7f094947466d45553a16d0209bb6155d5d9d3da3ab8ac8a3e0e2d91a54d85c24b893cb78313bb0d2840d210424a82f94add1f9d515925bb

    Score
    10/10
    formbookvjw0rmxloaderr4wfloaderpersistenceratspywarestealersuricatatrojanworm

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Vjw0rm

      Vjw0rm is a remote access trojan written in JavaScript.

      trojanwormvjw0rm

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • suricata: ET MALWARE FormBook CnC Checkin (GET)

      suricata: ET MALWARE FormBook CnC Checkin (GET)

      suricata

    • suricata: ET MALWARE FormBook CnC Checkin (POST) M2

      suricata: ET MALWARE FormBook CnC Checkin (POST) M2

      suricata

    • Xloader Payload

      rat

    • Blocklisted process makes network request

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks