Overview

overview

10

Static

static

SOR-0188-2...us.exe

windows7-x64

10

SOR-0188-2...us.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    SOR-0188-2022-E - Sea Orpheus.img

  • Size

    1010KB

  • Sample

    220914-mxn36sdffp

  • MD5

    51f67f0d1ad88ab9b728d7703e027a52

  • SHA1

    ec8210b4022763701a3bfcfd0f5a5561bb1f22ba

  • SHA256

    6f00ebfcf242f220697d267c3a54363aaaf73c285e667f6b63bf2db8761c2d4a

  • SHA512

    159ace80e4d92a8b52fdd8c128c3dfccfdec5ae638b5b9963d2b5d6cdb16ae22455d361ed4e4c1f11fc8736ee1a3f2818389ecae7d4189bdae638eb46b4f88c8

  • SSDEEP

    24576:8ZZ52XY+mzo3bvG639pyBw5saPNz0AKIUVDDo7VwG:q5glmzM9eBw70AUwR

Score
10/10
formbookxloader6hscloaderpersistenceratspywarestealertrojan

Malware Config

Extracted

Family

formbook

Campaign

6hsc

Decoy

6cvqXARAGlgdnnbXYQ==

Mi4yZ8FULou6w26U2FDnEbA=

Xmx0bJmRZGL+O0RFfLFNN9AMdwn+

B0WNhyl4T2gWBIqE1VDnEbA=

DI2G9/sG/v6YIh42aQ==

0NTaAl90ZWYiGV/bT4U=

DWCuXrL23Cc3xdIG/0dT

fTbzys/dddqOVQ==

8ClrDFi3i+asgxBOnguhlQ==

YjOkWLSpXeqrXw==

gAIov8vbtv8vr8/tFSXvDULL7thokKA=

xMW2qsXay7xNkonR/zxPo939

xc38fRlgO2opnnbXYQ==

+o31vQlURJKmLUWfHlMq0Gjs

z6GwWxCSKJLJ

2pnQ5evpehAxUt4hd6pq9X71

2CmXDSU2DTmDR+Q=

WV9ScxFQID1V2glQnguhlQ==

L8UDlK65h9wJ7Zeb3VDnEbA=

Agb4LF2bRcDX

Targets

    • Target

      SOR-0188-2022-E - Sea Orpheus.exe

    • Size

      950KB

    • MD5

      497c28055538b22271806bf472034d27

    • SHA1

      b05dd3289d926fe7b0347df3d2b87fcc603a004f

    • SHA256

      ad5003b210c5ed8b9de400328290e3955bdb07de23731475934c299a52dc6e98

    • SHA512

      65ac88594384c2282c95479f9f5240a1a99a78c5c1915c813eda97b1e0012dcac523d3a644c2824604a908070508856cd0cfbf60e2eb9e19368e147ec0c72f49

    • SSDEEP

      24576:NZZ52XY+mzo3bvG639pyBw5saPNz0AKIUVDDo7VwG:l5glmzM9eBw70AUwR

    Score
    10/10
    formbookxloader6hscloaderratspywarestealertrojanpersistence

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader payload

      rat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Command-Line Interface

1
T1059

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks