Overview

overview

10

Static

static

3

9009282736273.exe

windows7-x64

10

9009282736273.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    9009282736273.exe

  • Size

    762KB

  • Sample

    230703-jv5rcsgg3w

  • MD5

    7b9d1ae776aabfa0caa2a92ac560e5ff

  • SHA1

    63f542061e71b521bc6adee45e163d77a3b60898

  • SHA256

    6a7be0b8db3655e564255f25f80cdda361dcb00b477622db0bab226502860433

  • SHA512

    8c10211b8ab469e0467d641ad6f69a48dc0a85606068edd64ea55d9032fac493ba3a7cb7b00de4aa099db4aedfec14721bce9cbb93237b32db09959cc738a248

  • SSDEEP

    12288:VPRdmMlUOv2nhg+kX0WmSJXkP4xIMlnXkr:VJddU7nS+FJSiPvMlnXk

Score
10/10
modiloaderxloaderuj3cloaderpersistenceratspywarestealertrojan

Malware Config

Extracted

Family

xloader

Version

2.6

Campaign

uj3c

Decoy

copimetro.com

choonchain.com

luxxwireless.com

fashionweekofcincinnati.com

campingshare.net

suncochina.com

kidsfundoor.com

testingnyc.co

lovesoe.com

vehiclesbeenrecord.com

socialpearmarketing.com

maxproductdji.com

getallarticle.online

forummind.com

arenamarenostrum.com

trisuaka.xyz

designgamagazine.com

chateaulehotel.com

huangse5.com

esginvestment.tech

Targets

    • Target

      9009282736273.exe

    • Size

      762KB

    • MD5

      7b9d1ae776aabfa0caa2a92ac560e5ff

    • SHA1

      63f542061e71b521bc6adee45e163d77a3b60898

    • SHA256

      6a7be0b8db3655e564255f25f80cdda361dcb00b477622db0bab226502860433

    • SHA512

      8c10211b8ab469e0467d641ad6f69a48dc0a85606068edd64ea55d9032fac493ba3a7cb7b00de4aa099db4aedfec14721bce9cbb93237b32db09959cc738a248

    • SSDEEP

      12288:VPRdmMlUOv2nhg+kX0WmSJXkP4xIMlnXkr:VJddU7nS+FJSiPvMlnXk

    Score
    10/10
    modiloadertrojanxloaderuj3cloaderpersistenceratspywarestealer

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • ModiLoader Second Stage

    • Xloader payload

      rat

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks