Overview

overview

10

Static

static

13d97308ca...69.exe

windows7_x64

10

13d97308ca...69.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    5544835851386880.zip

  • Size

    4.4MB

  • Sample

    210812-vz4twltp5a

  • MD5

    99aa342771928acf2d245a78e95d7ffe

  • SHA1

    14cd538764217cb2f09603ec2196ad971fbdbe8d

  • SHA256

    ac00f76b8b9b7a4da749a85063b49c446b4b50e9837907c737a4675bcee43c3d

  • SHA512

    8e42c097b0cb7ccab4ec647d28ffd894f7e20bd7bec5ba6482dc8d243f4b9a493840034947d12a92e1ceca8224a255f481de25e5a79bcdb1587feb36dcb49f21

Score
10/10
xloaderavc9loaderpersistencepyinstallerratsuricata

Malware Config

Extracted

Family

xloader

Version

2.3

Campaign

avc9

C2

http://www.buyershealthy.com/avc9/

Decoy

thejamalpur.com

oneofthemthere.com

instaleadsolutionsllc.com

dorchestercountyhomehunter.com

digirmbbank.com

taeheavyequipmentparts.xyz

topless.cloud

heatherhuntercoaching.com

pennysworld.net

auirz.xyz

conserfic.com

haroopet.com

perazabenefits.com

tuftmultimodal.com

quanlailai.com

revealsonwheels.com

rafaellaepedro.com

cowbex.info

cobject-studio.com

odp.xyz

Targets

    • Target

      13d97308ca4e87d31024b1fcbfca7f7fdac365a4bf2264ca18499847d411bb69

    • Size

      4.4MB

    • MD5

      57c89dd8d8ff1fd5192ce1c48c3acbd6

    • SHA1

      c3a94aedc5fce3afdafe25ac648f3579e71cfaf3

    • SHA256

      13d97308ca4e87d31024b1fcbfca7f7fdac365a4bf2264ca18499847d411bb69

    • SHA512

      bdb1017d539ebdaf39b921ce580d064bd5d148d53def3c0b6879b469e798b212b70e334026c33bf5418afd40a507becb0898df2848b17ec3c961bf2e8bc32479

    Score
    10/10
    xloaderavc9loaderpersistencepyinstallerratsuricata

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • suricata: ET MALWARE FormBook CnC Checkin (GET)

      suricata: ET MALWARE FormBook CnC Checkin (GET)

      suricata

    • Xloader Payload

      rat

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks