Overview

overview

10

Static

static

vbc.exe

windows7_x64

10

vbc.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    vbc.exe

  • Size

    991KB

  • Sample

    211014-nbfqcaghg7

  • MD5

    a65b1815177ef9eba7e5e894bbf65a3c

  • SHA1

    5459ecf044e62bfb53220d0e78a5b98c24f17e25

  • SHA256

    298d542746dfa4922dd5fbc8fab572be58447c9dbd1481c55bd2254bb275684f

  • SHA512

    0f05d5e05d51fbe5289330ca2c5486c49369728005c6d19b548d3f419fbf52f25aa50007271b315636aedb311a43485989e4f6de8154869d0ac7affb0f0e3db1

Score
10/10
xloaderht08loaderpersistencerat

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

ht08

C2

http://www.septemberstockevent200.com/ht08/

Decoy

joye.club

istanbulemlakgalerisi.online

annikadaniel.love

oooci.com

curebase-test.com

swisstradecenter.com

hacticum.com

centercodebase.com

recbi56ni.com

mmj0115.xyz

sharpstead.com

sprklbeauty.com

progettogenesi.cloud

dolinum.com

amaroqadvisors.com

traininig.com

leewaysvcs.com

nashhomesearch.com

joy1263.com

serkanyamac.com

Targets

    • Target

      vbc.exe

    • Size

      991KB

    • MD5

      a65b1815177ef9eba7e5e894bbf65a3c

    • SHA1

      5459ecf044e62bfb53220d0e78a5b98c24f17e25

    • SHA256

      298d542746dfa4922dd5fbc8fab572be58447c9dbd1481c55bd2254bb275684f

    • SHA512

      0f05d5e05d51fbe5289330ca2c5486c49369728005c6d19b548d3f419fbf52f25aa50007271b315636aedb311a43485989e4f6de8154869d0ac7affb0f0e3db1

    Score
    10/10
    xloaderht08loaderpersistencerat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Uses the VBS compiler for execution

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

1
T1064

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Scripting

1
T1064

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks