Overview

overview

10

Static

static

TR0627729920002.exe

windows7-x64

1

TR0627729920002.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    TR0627729920002.exe

  • Size

    916KB

  • Sample

    220808-wsk1dsgch6

  • MD5

    8dbfe68662123710d83fef939287d9a3

  • SHA1

    9481ef5498dd490e4efe83601f916ee48f61e649

  • SHA256

    663b7bc66499e507ca1f8fad6e42195a54fe242db3cc71bf4762952fe04ce5ee

  • SHA512

    2f3589181a606a3342726b92ecbdf722e43752a281a7e628de44f142b75bb7150814d515d2c03495f52362106b3f9d8990de4661e60cf8104f2f5ec6bcd161bc

Score
10/10
formbookmodiloaderxloaderuj3cloaderpersistenceratspywarestealertrojan

Malware Config

Extracted

Family

xloader

Version

2.6

Campaign

uj3c

Decoy

copimetro.com

choonchain.com

luxxwireless.com

fashionweekofcincinnati.com

campingshare.net

suncochina.com

kidsfundoor.com

testingnyc.co

lovesoe.com

vehiclesbeenrecord.com

socialpearmarketing.com

maxproductdji.com

getallarticle.online

forummind.com

arenamarenostrum.com

trisuaka.xyz

designgamagazine.com

chateaulehotel.com

huangse5.com

esginvestment.tech

Targets

    • Target

      TR0627729920002.exe

    • Size

      916KB

    • MD5

      8dbfe68662123710d83fef939287d9a3

    • SHA1

      9481ef5498dd490e4efe83601f916ee48f61e649

    • SHA256

      663b7bc66499e507ca1f8fad6e42195a54fe242db3cc71bf4762952fe04ce5ee

    • SHA512

      2f3589181a606a3342726b92ecbdf722e43752a281a7e628de44f142b75bb7150814d515d2c03495f52362106b3f9d8990de4661e60cf8104f2f5ec6bcd161bc

    Score
    10/10
    formbookmodiloaderxloaderuj3cloaderpersistenceratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader payload

      rat

    • Adds policy Run key to start application

      persistence

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

2
T1060

Privilege Escalation

Defense Evasion

Modify Registry

3
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks