Overview

overview

10

Static

static

SALES CONT...1.xlsx

windows7_x64

10

SALES CONT...1.xlsx

windows10_x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    SALES CONTRACT 914 VIPA ORDER 213581.xlsx

  • Size

    587KB

  • Sample

    210921-jwjkhsbdfr

  • MD5

    57d15b392c41d1fef88631aa16d1717f

  • SHA1

    19edf447fb1f102d85f22df4bdc13f8b5a3504bc

  • SHA256

    16b2ff1b7878c49d974b08f7a91669a472c4bfacbfbf486209c6cefe2c117302

  • SHA512

    6eba268985edf22d1cd0f6e9f905fc6b1896009fed103b221b100447a6c8d85c8d5316f22a333be61594361bf71c3b411ae30f588e933bb73cc32f745519147d

Score
10/10
xloader9gdgloaderratsuricata

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

9gdg

C2

http://www.dechocolate.online/9gdg/

Decoy

cao-catos.ca

humanityumbrella.com

heatherflintford.com

paddyjulian.com

venturedart.com

pimpyoursmile.com

shellbacklabs.com

acesteeisupply.com

socotrajeweltours.com

aykutozden.com

corncobmeal.com

lesbiansforever.com

picknock.com

pawspetreiki.com

waikikidesignco.com

lelittnpasumo4.xyz

billing-updating.info

barangdapo.com

gatorfirerescue.com

jmovt.com

Targets

    • Target

      SALES CONTRACT 914 VIPA ORDER 213581.xlsx

    • Size

      587KB

    • MD5

      57d15b392c41d1fef88631aa16d1717f

    • SHA1

      19edf447fb1f102d85f22df4bdc13f8b5a3504bc

    • SHA256

      16b2ff1b7878c49d974b08f7a91669a472c4bfacbfbf486209c6cefe2c117302

    • SHA512

      6eba268985edf22d1cd0f6e9f905fc6b1896009fed103b221b100447a6c8d85c8d5316f22a333be61594361bf71c3b411ae30f588e933bb73cc32f745519147d

    Score
    10/10
    xloader9gdgloaderratsuricata

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • suricata: ET MALWARE FormBook CnC Checkin (GET)

      suricata: ET MALWARE FormBook CnC Checkin (GET)

      suricata

    • suricata: ET MALWARE Possible Malicious Macro DL EXE Feb 2016

      suricata: ET MALWARE Possible Malicious Macro DL EXE Feb 2016

      suricata

    • Xloader Payload

      rat

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Uses the VBS compiler for execution

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

1
T1064

Exploitation for Client Execution

1
T1203

Persistence

Privilege Escalation

Defense Evasion

Scripting

1
T1064

Modify Registry

1
T1112

Credential Access

Discovery

System Information Discovery

3
T1082

Query Registry

2
T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks