Overview

overview

10

Static

static

arrival notice.exe

windows7_x64

10

arrival notice.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    arrival notice.exe

  • Size

    762KB

  • Sample

    210915-g7rzxsdaej

  • MD5

    4196c697fa8a52ecddad63bf5ac9e8f9

  • SHA1

    1179a7916f59fa2d88829a56f3f045e1cf32c418

  • SHA256

    cfdb27a9ff39bd1aa5a0a43fe6e272c269a311f5748d8a13b2e705f7d66f16bd

  • SHA512

    8c78d2a8276fd10c118732b194865fcd40615beb8ad47459e0ce5c67097d57d66c5764c0eaf8ebdbb7591b3ff03c26f0aa90d7dd7484b8f4709c9a79c607d5a0

Score
10/10
xloadern58iloaderratsuricata

Malware Config

Extracted

Family

xloader

Version

2.4

Campaign

n58i

C2

http://www.nordicbatterybelt.net/n58i/

Decoy

southerncircumstance.com

mcsasco.com

ifbrick.com

societe-anonyme.net

bantank.xyz

dogecoin.beauty

aboutacoffee.com

babalandlordrealestate.com

tintgta.com

integrity.directory

parwnr.icu

poltishof.online

stayandstyle.com

ickjeame.xyz

currentmotors.ca

pond.fund

petrosterzis.com

deadbydaylightpoints.com

hotel-balzac.paris

focusmaintainance.com

Targets

    • Target

      arrival notice.exe

    • Size

      762KB

    • MD5

      4196c697fa8a52ecddad63bf5ac9e8f9

    • SHA1

      1179a7916f59fa2d88829a56f3f045e1cf32c418

    • SHA256

      cfdb27a9ff39bd1aa5a0a43fe6e272c269a311f5748d8a13b2e705f7d66f16bd

    • SHA512

      8c78d2a8276fd10c118732b194865fcd40615beb8ad47459e0ce5c67097d57d66c5764c0eaf8ebdbb7591b3ff03c26f0aa90d7dd7484b8f4709c9a79c607d5a0

    Score
    10/10
    xloadern58iloaderratsuricata

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • suricata: ET MALWARE FormBook CnC Checkin (GET)

      suricata: ET MALWARE FormBook CnC Checkin (GET)

      suricata

    • Xloader Payload

      rat

    • Blocklisted process makes network request

    • Deletes itself

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Command-Line Interface

1
T1059

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks