Overview

overview

10

Static

static

DHL Packag...88.exe

windows7_x64

10

DHL Packag...88.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    DHL Package _00099088.exe

  • Size

    508KB

  • Sample

    220706-te3beaeegj

  • MD5

    45dfc5671eca20fa6dc4ed9fa70ec804

  • SHA1

    0f483b3fb308168e3af3ce46fcccbde1265da7a3

  • SHA256

    06b80b5b146259aedc1c2f1da5253e2ad1dadae5ba7577a8cc2ce93191f05fa1

  • SHA512

    2e325dae6375815657cea18f3cd26f6ef59dd279d3c7251432b86c3dad554c31b9ded2623841d73cae554c54f5541735793131a40ccfd43eeca2b8c155253255

Score
10/10
formbookxloaderq80oloaderpersistenceratspywarestealersuricatatrojan

Malware Config

Extracted

Family

xloader

Version

2.8

Campaign

q80o

Decoy

f7mdaO1bGlX5Y2KU0dHQaA==

Mps3KuD8zIc+NieaquJSbJf4U75PQQ==

XDEHE8tpP4Uwl4NwhsevSqgqP5ct/8Q=

CEQUvkPpweaRAuejNpsk

eknJn0MoEfumZie5yfrBvueX

8oIe8Jy9cTTiBJQ2KQ==

6/uwsnRgUVcChTCjNpsk

OlNvP2P/9Q==

PRAK+/9rNmwT

WC+kTLpjVUQcW14=

UBHyqBYIxX0rI8b3U7MwdKvk/tcjH90=

OaE5CqzVdrSXjokQNg==

pHhRDF7Q2kf2YB5bIywkhp0=

Dg+chDsoFRbFaiGnugOCof5zF9Pr

Qs+IMKxNKFFEizXk

gnDbWFzyYCcEgwoT/mA=

e8GaWAb7quKJREE=

vnEZ65pK59F1Fvex9dw2SbUXMg==

JWlLFJP5ceeM6q2lnt1ZlvK1vtQ=

UblHILLigo4hiA==

Targets

    • Target

      DHL Package _00099088.exe

    • Size

      508KB

    • MD5

      45dfc5671eca20fa6dc4ed9fa70ec804

    • SHA1

      0f483b3fb308168e3af3ce46fcccbde1265da7a3

    • SHA256

      06b80b5b146259aedc1c2f1da5253e2ad1dadae5ba7577a8cc2ce93191f05fa1

    • SHA512

      2e325dae6375815657cea18f3cd26f6ef59dd279d3c7251432b86c3dad554c31b9ded2623841d73cae554c54f5541735793131a40ccfd43eeca2b8c155253255

    Score
    10/10
    formbookxloaderq80oloaderpersistenceratspywarestealersuricatatrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • suricata: ET MALWARE FormBook CnC Checkin (GET)

      suricata: ET MALWARE FormBook CnC Checkin (GET)

      suricata

    • Xloader Payload

      rat

    • Adds policy Run key to start application

      persistence

    • Blocklisted process makes network request

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

3
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks