Overview

overview

10

Static

static

Purchase Order.exe

windows7_x64

10

Purchase Order.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Purchase Order.exe

  • Size

    893KB

  • Sample

    220622-zsb92adbd2

  • MD5

    001572ce1d689cab9270948ca76d61c0

  • SHA1

    5d833185231eca4887b43a87842f17e1970216c8

  • SHA256

    436b6a6031748458ed3e78927394bf124d79e779ccb81eb7329beb9eaa3e9b17

  • SHA512

    82f754e319e765aa3c756483d10f3d8415b458bc75c1c3d2bb1f2fd39e8b68adc20fa1640f0d9d00634f2efe9f0cff7bc423b55cded390665794c1e24a045ff5

Score
10/10
xloadernn40loaderratspywarestealersuricata

Malware Config

Extracted

Family

xloader

Version

2.8

Campaign

nn40

Decoy

LYAg0yANOGEAGeaFOrA/

MQWuERZplP+VZy/uszI=

CF0oDN0JimIaGy/uszI=

ltJnyC+ReohYaiTvj1qbEA==

B9OkgdctVKBAFjSUaw==

sbDVwSZVVqVB11/deow8GA==

v1gHDe0pzno=

i+/0n2vHUfGPR98k77tukZ90MQ==

SUtCnbS96Qm21g==

8X9qzyt1dpAo31jXrXfKb49fBPY=

5KlPxqHzSstuFjSUaw==

0r/Kesv/zuanroxvNQW0Gm8=

FFgS7kfPYAqpdhhgRgnBJHY=

LgusAHrkrIoWr0FWIe2o/04UXPw=

vBq9Gvxa9wbKbS/uszI=

Z+q6HAZNNeqwwQ==

wbS4fMb06SjU5Kbseow8GA==

1mZEuZvJ/m0L9bof56PkkZ90MQ==

JCJIM74lHk/o+tiFOrA/

d14FrM8rGEgIzVkT67+3XaEh

Targets

    • Target

      Purchase Order.exe

    • Size

      893KB

    • MD5

      001572ce1d689cab9270948ca76d61c0

    • SHA1

      5d833185231eca4887b43a87842f17e1970216c8

    • SHA256

      436b6a6031748458ed3e78927394bf124d79e779ccb81eb7329beb9eaa3e9b17

    • SHA512

      82f754e319e765aa3c756483d10f3d8415b458bc75c1c3d2bb1f2fd39e8b68adc20fa1640f0d9d00634f2efe9f0cff7bc423b55cded390665794c1e24a045ff5

    Score
    10/10
    xloadernn40loaderratspywarestealersuricata

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • suricata: ET MALWARE FormBook CnC Checkin (GET)

      suricata: ET MALWARE FormBook CnC Checkin (GET)

      suricata

    • suricata: ET MALWARE FormBook CnC Checkin (POST) M2

      suricata: ET MALWARE FormBook CnC Checkin (POST) M2

      suricata

    • Xloader Payload

      rat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks