Overview

overview

10

Static

static

fzejdpOSxr_bin.js

windows7_x64

10

fzejdpOSxr_bin.js

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    fzejdpOSxr_bin.js

  • Size

    359KB

  • Sample

    220705-pp2qeabaf9

  • MD5

    84fa540039df7abc11a136c8a43fde22

  • SHA1

    175daef8a581ff8ae86cded1cb6f68373d665dda

  • SHA256

    d5e68b8de115bfa8d06d5f407c3e6f9c95f545ff4a9ee16f9ba2706993cdd7c0

  • SHA512

    7715e6ae047fdfee1ba18aa1adccb28f1608b591a5e710c687f8c599486163b85a432edbbebdeef2301cf779c969cfee1578ad75a57aceb6f8589b2c054595b5

Score
10/10
formbookxloadermdzqloaderpersistenceratspywarestealersuricatatrojan

Malware Config

Extracted

Family

xloader

Version

2.6

Campaign

mdzq

Decoy

leop.red

actoconcept.fr

doesmee.com

goplygolf.com

cqshki.net

leflegme.com

wgamersport.xyz

4513367.com

shpoweronline.com

ingeniousconsultingservices.com

dentaldenalia.com

saaraba.net

artnow.media

sbwyt.com

nortonrosefulbrigiht.com

autorad.xyz

clergyfundingandinsurance.com

boarko.com

xn--zoom-kh4j.com

739lakemuirdr.com

Targets

    • Target

      fzejdpOSxr_bin.js

    • Size

      359KB

    • MD5

      84fa540039df7abc11a136c8a43fde22

    • SHA1

      175daef8a581ff8ae86cded1cb6f68373d665dda

    • SHA256

      d5e68b8de115bfa8d06d5f407c3e6f9c95f545ff4a9ee16f9ba2706993cdd7c0

    • SHA512

      7715e6ae047fdfee1ba18aa1adccb28f1608b591a5e710c687f8c599486163b85a432edbbebdeef2301cf779c969cfee1578ad75a57aceb6f8589b2c054595b5

    Score
    10/10
    xloadermdzqloaderpersistenceratsuricataformbookspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • suricata: ET MALWARE FormBook CnC Checkin (GET)

      suricata: ET MALWARE FormBook CnC Checkin (GET)

      suricata

    • suricata: ET MALWARE FormBook CnC Checkin (POST) M2

      suricata: ET MALWARE FormBook CnC Checkin (POST) M2

      suricata

    • Xloader Payload

      rat

    • Adds policy Run key to start application

      persistence

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

2
T1060

Privilege Escalation

Defense Evasion

Modify Registry

4
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks