Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    DOCUMENTO DE ENVÍO DE DHL AWB _111832457673,pdf.exe

  • Size

    461KB

  • Sample

    220927-t2hkhsfabl

  • MD5

    26860d51fddf664076d1cf601e43ba1d

  • SHA1

    dcd3fa1f67c3a7496caebd09c40cf8c6e5846c53

  • SHA256

    7a73079ae74c6c75f4f72bdae2437960533e8532a26b10dc98df4d8caf272f5e

  • SHA512

    e7aca103565635e73a5ce0fe64027dfdec356390f39537aec134611a6aeee176f666e5aada2cae90cebb7d3002bce43c0c251a79f28d95a09ca1a36e159dd513

  • SSDEEP

    12288:vj3ZrR7VyT/IdT5D7E61U6NolW1M6wRs:vj9Rs/IdFPU6+l0

Malware Config

Extracted

Family

formbook

Campaign

nrln

Decoy

IG7zJSm49UqTTuu/N/oTCIg=

CVLdAPgw0CRSMuZnRRU=

PiA5Z3umP2NyX81VGQhjWyS59nFYhXiG

5i6p4GeQqtBgNRfGNQ==

5984keYswxh8mGZHz4ipAHtQ

VNJaK4Gh0CrOvHpW/p353A==

71rEtrL2icToyKGhcWrTxjsFU5T98zeO

r3q1sy1iZaL+2XIUAob7yw==

9+83Qkrk/vV/jVXsDvoTCIg=

aMFAgYF1prov8/UErH/Y1A==

Alqtx/0rxwEbCLdudftl

ImCbnglBSUHF0mv2tTSP40bPeYao

s4DFNvAJ4GIJ+g==

phOa6mtS8QQICuZnRRU=

7TSu5vqRtB45EZtf4WDSTBHPeYao

ImPWqwUUIVWMQLyMbUab7tmspvNCcT8=

HF7jKjbGox2SAffTPw==

yAM3mOQot5l+cD0ikR5MGp8=

UYzW0/8z70JcQenVLidu1kLPeYao

OoCznp5UWz+hT9OBFXbfVhXPeYao

Extracted

Family

xloader

Version

3.8

Campaign

nrln

Decoy

IG7zJSm49UqTTuu/N/oTCIg=

CVLdAPgw0CRSMuZnRRU=

PiA5Z3umP2NyX81VGQhjWyS59nFYhXiG

5i6p4GeQqtBgNRfGNQ==

5984keYswxh8mGZHz4ipAHtQ

VNJaK4Gh0CrOvHpW/p353A==

71rEtrL2icToyKGhcWrTxjsFU5T98zeO

r3q1sy1iZaL+2XIUAob7yw==

9+83Qkrk/vV/jVXsDvoTCIg=

aMFAgYF1prov8/UErH/Y1A==

Alqtx/0rxwEbCLdudftl

ImCbnglBSUHF0mv2tTSP40bPeYao

s4DFNvAJ4GIJ+g==

phOa6mtS8QQICuZnRRU=

7TSu5vqRtB45EZtf4WDSTBHPeYao

ImPWqwUUIVWMQLyMbUab7tmspvNCcT8=

HF7jKjbGox2SAffTPw==

yAM3mOQot5l+cD0ikR5MGp8=

UYzW0/8z70JcQenVLidu1kLPeYao

OoCznp5UWz+hT9OBFXbfVhXPeYao

Targets

    • Target

      DOCUMENTO DE ENVÍO DE DHL AWB _111832457673,pdf.exe

    • Size

      461KB

    • MD5

      26860d51fddf664076d1cf601e43ba1d

    • SHA1

      dcd3fa1f67c3a7496caebd09c40cf8c6e5846c53

    • SHA256

      7a73079ae74c6c75f4f72bdae2437960533e8532a26b10dc98df4d8caf272f5e

    • SHA512

      e7aca103565635e73a5ce0fe64027dfdec356390f39537aec134611a6aeee176f666e5aada2cae90cebb7d3002bce43c0c251a79f28d95a09ca1a36e159dd513

    • SSDEEP

      12288:vj3ZrR7VyT/IdT5D7E61U6NolW1M6wRs:vj9Rs/IdFPU6+l0

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Xloader

      Xloader is a rebranded version of Formbook malware.

    • Blocklisted process makes network request

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks