Overview

overview

10

Static

static

3

0034524600927.exe

windows7-x64

10

0034524600927.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0034524600927.zip

  • Size

    460KB

  • Sample

    230705-m9afjsdc21

  • MD5

    0fd165df652327d9123be8fb32029288

  • SHA1

    0b9e1aa10c29ceacb8d9c1fac95cfdc429b880c6

  • SHA256

    571fb2933ffd9e7d4c8083fc03ff9f4809590ec5632256e2195c15888a632e01

  • SHA512

    028b2b40ebd145e4ba5a3dd426ac93a7c01a7c9dea392e58fde54d0a7f0b29b25153837e27484b207d31b447c8ce42262e5054deb3e5369b7be2bde15bdd7cb6

  • SSDEEP

    12288:Lt2X2JkBVmlrHGdxAqKz0XVUl3QhTuKGpfVj+en:J2GJkq58xTKgFqAh81+en

Score
10/10
modiloaderxloaderuj3cloaderpersistenceratspywarestealertrojan

Malware Config

Extracted

Family

xloader

Version

2.6

Campaign

uj3c

Decoy

copimetro.com

choonchain.com

luxxwireless.com

fashionweekofcincinnati.com

campingshare.net

suncochina.com

kidsfundoor.com

testingnyc.co

lovesoe.com

vehiclesbeenrecord.com

socialpearmarketing.com

maxproductdji.com

getallarticle.online

forummind.com

arenamarenostrum.com

trisuaka.xyz

designgamagazine.com

chateaulehotel.com

huangse5.com

esginvestment.tech

Targets

    • Target

      0034524600927.exe

    • Size

      908KB

    • MD5

      f5220848536bead29722b6a03c8af4f3

    • SHA1

      42c7c02da18a22f21dfb930e3428a8446c5fac9a

    • SHA256

      85383a8f1761aba192877153fbca884993d7b54e2673481a1bb78648f58f236e

    • SHA512

      0e908b4f792e87b19738e1f1f361d1150993d8739023dbd97fa3511ad11d134132130c5b39a1d32ab70331e886f8b7cd6ad7a2863cd53000150d64ea81c2ee1f

    • SSDEEP

      24576:xgLzNa28Rcr2O86+6MDUlnEXYfWGgvD7QKM:xgL4HA2/KRJ

    Score
    10/10
    modiloadertrojanxloaderuj3cloaderpersistenceratspywarestealer

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • ModiLoader Second Stage

    • Xloader payload

      rat

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks