Overview

overview

10

Static

static

Stamped Agreement.exe

windows7_x64

10

Stamped Agreement.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Stamped Agreement.lzh

  • Size

    634KB

  • Sample

    210815-lgvpzwzmex

  • MD5

    13f7ac3ff9f20fbf5e94647a7654c81f

  • SHA1

    62b5e8836bd598ba23d18208ac11ceef682d5286

  • SHA256

    eddb900c9e73f050ce4a90866c3923abf4bee473aedd23b2ac603868cd88f311

  • SHA512

    e7077a47f12118db94befac49e90eaf5f1c2b1e9e65d4694d97dab90235dd51a909d4d169ecf2cef5806a6abf2b1f52109318d28e16effa9aa14d77ce38b66b5

Score
10/10
xloaderipa8loaderratsuricata

Malware Config

Extracted

Family

xloader

Version

2.3

Campaign

ipa8

C2

http://www.desarrollosolucionesnavarro.com/ipa8/

Decoy

royalposhpups.com

univa.world

lanerbo.com

shopbabygo.com

theutahhomestore.com

serialmixer.icu

linfeiya.com

xn--12cg3de5c2eb5cyi.com

am-conseil-communication.com

dailygame168.com

therightmilitia.com

visions-agency.com

mapopi.com

frugallyketo.com

guapandglo.com

54w-x126v.net

your-health-kick.com

blockchainhub360.com

registernowhd.xyz

votekellykitashima.com

Targets

    • Target

      Stamped Agreement.exe

    • Size

      1.0MB

    • MD5

      d4ea38bc35cb738b29f73e6750923a95

    • SHA1

      8a4d5b7fa21b73f189b82565e3748368148b6a26

    • SHA256

      3edf6811850efc722b39737bf3623a42127e728f0c32a0a6ab7c66044838d307

    • SHA512

      b72774638a4dd856220117dc9f29bacf0166db6519ecd1f023a446829d403715d6b4a2d8bbb9783b32e412376194e63368a300d1ac326e440c40d9ff6128d958

    Score
    10/10
    xloaderipa8loaderratsuricata

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • suricata: ET MALWARE FormBook CnC Checkin (GET)

      suricata: ET MALWARE FormBook CnC Checkin (GET)

      suricata

    • Xloader Payload

      rat

    • Deletes itself

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Command-Line Interface

1
T1059

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks