Overview

overview

10

Static

static

DHL AWB# 4...df.exe

windows7_x64

10

DHL AWB# 4...df.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    DHL AWB# 4AB19037XXX.pdf.exe

  • Size

    11KB

  • Sample

    210927-wvm8jahga5

  • MD5

    690684b6b6a432ef5f8b34b67653d4be

  • SHA1

    34b072cdd785e0be9bf9717707a72c122ebf8e93

  • SHA256

    2ea667119c0aeda764dcb53a2adf480a26985bfc682949d0fb0c02d266342c68

  • SHA512

    b074acee0f6505a1c179af3149bc9146719b0df0bf6f0efa668d611ff388dc36f5cd7ed3c7c8a98317895ef716818ec0c3841ccff96aba0ba5ce8da15c0c6eb5

Score
10/10
xloadero4umloaderrat

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

o4um

C2

http://www.dependablelawnsnow.com/o4um/

Decoy

kagami-belt.com

k7e.xyz

slowcontentmarketing.com

nativeamericannurse.com

stadtquartier.xyz

vietlinkmart.com

numisme.xyz

lypp-sh.com

walkerwaughray.com

homerightsolutions.com

vpdd.top

857741.com

informednewsreader.com

misachoavien.com

aslanrefinedhomes.com

bjhaitaoshop.com

lb-fo.com

shadedfaetattoos.com

tallulahapp.com

amhonlinemarketing.com

Targets

    • Target

      DHL AWB# 4AB19037XXX.pdf.exe

    • Size

      11KB

    • MD5

      690684b6b6a432ef5f8b34b67653d4be

    • SHA1

      34b072cdd785e0be9bf9717707a72c122ebf8e93

    • SHA256

      2ea667119c0aeda764dcb53a2adf480a26985bfc682949d0fb0c02d266342c68

    • SHA512

      b074acee0f6505a1c179af3149bc9146719b0df0bf6f0efa668d611ff388dc36f5cd7ed3c7c8a98317895ef716818ec0c3841ccff96aba0ba5ce8da15c0c6eb5

    Score
    10/10
    xloadero4umloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Downloads MZ/PE file

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Command-Line Interface

1
T1059

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks