General

  • Target

    20009389_pdf.js

  • Size

    347KB

  • Sample

    220921-qndsmagdb6

  • MD5

    789c174473988e1a09161dc099ab5242

  • SHA1

    eb2b554e3218d76bd4d8c711667825fc4ea1ba62

  • SHA256

    8b5beadb2b911f135987247781258de556dfbdcc58475dbba1702a414aa099df

  • SHA512

    c7c1a40cac47b5068adc9f32f959fbcded69461dfe36649ddf3237dda8907db237b17c8c75987260812ffd9bb26f47489cf91e7510ed838620a1e269b8fbf49f

  • SSDEEP

    6144:7mCYKw13CEAaCo1SfZFouO0Y/W86lnSUMSxZ3VhflI9xeuRu:+NfCZwuO0YInSUMEZ3DlITpQ

Malware Config

Extracted

Family

formbook

Campaign

xrob

Decoy

dV8FCtdWdnfMJ9thh8l/

IJG6Bh4iMeHVBHNp2MrpTA==

NhPKKtmQxnHYF/80

f4M2RhGEf3Ot13+qLrKqxb9f3dXj9Q==

A/689/MibSRBgkPkx07m+H+g

e8OOkUu9y/uYCMsdrR3s0mODmGw3d8t9Og==

gLN5bn+Zq1VQXmOOvw==

NFcQGvViY5sxmkty83Fde4GQhg==

XWMfFSM3f7GT9w==

Ih6vvqf9R8gDObM=

FGAlLASHlpLaUUKUJIwm9ABQ2Js=

v8R615LDC8iWchwv

m+u3rLUxScgDObM=

jc3eahERf7GT9w==

TYNBVDadkpTF76HeNl/rbwWtLSbyPzM=

j6NQmhWeOi2B

aqJocUfM3v97ryScY6EiSMbVyBak

V7nYOyEZKa2J/KKh5RMhJrbyK/eC/Q==

8zPsAt3ejcgDObM=

Rpe+BrGBzpGa9q8FHKpi

Extracted

Family

xloader

Version

3.8

Campaign

xrob

Decoy

dV8FCtdWdnfMJ9thh8l/

IJG6Bh4iMeHVBHNp2MrpTA==

NhPKKtmQxnHYF/80

f4M2RhGEf3Ot13+qLrKqxb9f3dXj9Q==

A/689/MibSRBgkPkx07m+H+g

e8OOkUu9y/uYCMsdrR3s0mODmGw3d8t9Og==

gLN5bn+Zq1VQXmOOvw==

NFcQGvViY5sxmkty83Fde4GQhg==

XWMfFSM3f7GT9w==

Ih6vvqf9R8gDObM=

FGAlLASHlpLaUUKUJIwm9ABQ2Js=

v8R615LDC8iWchwv

m+u3rLUxScgDObM=

jc3eahERf7GT9w==

TYNBVDadkpTF76HeNl/rbwWtLSbyPzM=

j6NQmhWeOi2B

aqJocUfM3v97ryScY6EiSMbVyBak

V7nYOyEZKa2J/KKh5RMhJrbyK/eC/Q==

8zPsAt3ejcgDObM=

Rpe+BrGBzpGa9q8FHKpi

Targets

    • Target

      20009389_pdf.js

    • Size

      347KB

    • MD5

      789c174473988e1a09161dc099ab5242

    • SHA1

      eb2b554e3218d76bd4d8c711667825fc4ea1ba62

    • SHA256

      8b5beadb2b911f135987247781258de556dfbdcc58475dbba1702a414aa099df

    • SHA512

      c7c1a40cac47b5068adc9f32f959fbcded69461dfe36649ddf3237dda8907db237b17c8c75987260812ffd9bb26f47489cf91e7510ed838620a1e269b8fbf49f

    • SSDEEP

      6144:7mCYKw13CEAaCo1SfZFouO0Y/W86lnSUMSxZ3VhflI9xeuRu:+NfCZwuO0YInSUMEZ3DlITpQ

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Vjw0rm

      Vjw0rm is a remote access trojan written in JavaScript.

    • Xloader

      Xloader is a rebranded version of Formbook malware.

    • Blocklisted process makes network request

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks