Overview

overview

10

Static

static

90c60c57ce...ce.exe

windows7_x64

10

90c60c57ce...ce.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    90c60c57ce0606d09dbd01751eb2bd5cd86d4344bd69ceb2f5697b1239070cce.zip

  • Size

    450KB

  • Sample

    210817-v33z1pwykn

  • MD5

    bea4ad496614db38bbb255f9410bdcd0

  • SHA1

    f27e28348220c48204c2337975d3dbbb1c623cff

  • SHA256

    50307805ba87921ad43b60e6321b682e3dfeeb3ab1622f5c1146c412530e6c11

  • SHA512

    c59af56170465754f532d1315a000122b7cf3d2d80cf22175f6cf7dee00b898e33b658593849271a4398d3765091b2302b3d5b5c25df8608e8072182e3e1d14b

Score
10/10
xloaderb8euagilenetloaderpersistenceratsuricata

Malware Config

Extracted

Family

xloader

Version

2.3

Campaign

b8eu

C2

http://www.yummylipz.net/b8eu/

Decoy

ppslide.com

savorysinsation.com

camilaediego2021.com

rstrunk.net

xianshikanxiyang.club

1borefruit.com

ay-danil.club

xamangxcoax.club

waltonunderwood.com

laurabissell.com

laurawmorrow.com

albamauto.net

usamlb.com

theoyays.com

freeitproject.com

jijiservice.com

ukcarpetclean.com

wc399.com

xn--pskrtmebeton-dlbc.online

exclusivemerchantsolutions.com

Targets

    • Target

      90c60c57ce0606d09dbd01751eb2bd5cd86d4344bd69ceb2f5697b1239070cce

    • Size

      727KB

    • MD5

      697603470394ef65a7996011adf0db69

    • SHA1

      7139f8e802aa6decce3ae28fd49c3d92b5e19823

    • SHA256

      90c60c57ce0606d09dbd01751eb2bd5cd86d4344bd69ceb2f5697b1239070cce

    • SHA512

      15a809d90a56b5b8544b994406ca954b39c3650977809e4531b684d6003b9ed597fd1c89c703d985ea898855d49cfb9b7d24f9c198c6c0d033d794c1e33167f6

    Score
    10/10
    xloaderb8euagilenetloaderratpersistencesuricata

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • suricata: ET MALWARE FormBook CnC Checkin (GET)

      suricata: ET MALWARE FormBook CnC Checkin (GET)

      suricata

    • suricata: ET MALWARE FormBook CnC Checkin (POST) M2

      suricata: ET MALWARE FormBook CnC Checkin (POST) M2

      suricata

    • Xloader Payload

      rat

    • Executes dropped EXE

    • Loads dropped DLL

    • Obfuscated with Agile.Net obfuscator

      Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

      agilenet

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Command-Line Interface

1
T1059

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

3
T1112

Install Root Certificate

1
T1130

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks